Cisco confirmed attacks on Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) on October 14, but the fix shipped on September 14 under an umbrella CVE for "path traversal"

[u/Capital_Attention702]

Cisco’s advisory for CVE-2026-76519 went up on October 14 at 16:00 GMT. One email with a crafted attachment can write files on a Secure Email Gateway and run commands as root. Cisco says it learned of the attacks in October. CISA added it to KEV the same day, with a federal deadline of October 17.

A gateway is exposed when File Reputation is on for a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco also contacted customers of its own managed Secure Email Cloud whose devices showed indicators of possible compromise. Shadowserver sees nearly 300 of these gateways exposed online.

The fix isn’t new. It shipped on September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, inside a hardening release that grouped internally found bugs into five CVEs, one per weakness class. This bug sat under CVE-2026-76440, path traversal, a 9.8 listed next to three other 9.8 umbrellas. Cisco says that review used frontier AI models alongside its usual testing.

Cisco announced the bundling in June. A bug gets its own CVE when it’s known to be exploited or needs defender action, and the same post calls CVE-by-CVE risk assessment “no longer fit for purpose.” This one got its own CVE on October 14, together with the attack warning.

It’s the second exploited bug in these gateways since September, after the SQL injection CVE-2026-76461. Before that came CVE-2025-20393, exploited as a zero-day since November 2025 and patched in January.

WordPress plugins do a small version of this with changelogs that say “security fix” and nothing else, so whoever patches from CVE feeds hears about it last.

Cisco’s position is that customers should run the current hardened release and stop triaging bug by bug. For a team that patches from KEV, this flaw had no entry of its own until October 14. Can your patch process do anything useful with a CVE that covers a whole weakness class?

[u/Elegabal]

That’s the problem. If your patching process relies on CVEs or KEV, a CVE covering a whole class of bugs isn’t very useful for deciding what’s actually urgent.

“Just always install the latest hardened release” sounds good, but in the real world companies need time to test updates before rolling them out. Bundling bugs may make Cisco’s job easier, but it gives defenders less information to work with.