思科“强烈”敦促客户修补其安全电子邮件网关（SEG）中又一个关键的“获取root权限”漏洞，该漏洞已在零日攻击中被利用。思科发言人告诉《国会山报》，该关键漏洞的CVSS评分为9.8（满分10分），影响“少量客户”。该漏洞现被追踪为CVE‑2026‑76519，允许远程未经身份验证的攻击者通过发送恶意邮件，在设备操作系统上写入文件并以root权限执行命令。
Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.”The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system - simply by sending a malicious email.
在周三的单独通告中，思科和美国政府均警告称，攻击者在思科发布修复程序之前就已利用了SEG的最新漏洞。美国网络安全和基础设施安全局（CISA）已将该漏洞加入其已知被利用漏洞目录，并设定周六为联邦机构修复该问题的截止日期。“我们已知晓该漏洞正被积极利用，”发言人说，但拒绝回答我们关于有多少设备被入侵以及攻击者利用此漏洞获取访问权限后在做什么的问题。
In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue. “We are aware of active exploitation of this vulnerability,” the spokesperson said, but declined to answer our questions about how many appliances had been compromised, and what attackers were doing with this access after exploiting the bug.
“我们强烈敦促客户升级到已修复的软件版本，并遵循我们通告中的其他建议和加固指南，”发言人说。该漏洞存在于SEG的高级恶意软件防护（AMP）功能中，原因是对电子邮件附件处理不当。攻击者可通过发送带有恶意附件的邮件来利用该漏洞，成功利用后即可在被入侵的设备上以root权限写入文件并执行命令。该漏洞影响运行易受攻击的Cisco AsyncOS Software版本的物理和虚拟SEG设备，前提是同时满足以下两个条件：思科AMP的一部分——文件信誉服务已启用并分配给邮件策略。内容扫描工具版本早于25.3.0.5525。
“We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory,” the spokesperson said. The flaw exists in SEG’s Advanced Malware Protection (AMP) feature, and it’s due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance. This vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met: The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525.
思科在周三发布的安全公告中列出了相关操作步骤，帮助各机构确认是否已启用“文件信誉”功能以及当前安装的是哪个版本的内容扫描工具——如果您不确定，不妨仔细查阅该公告。升级至已修复漏洞的思科AsyncOS软件版本即可修补这一安全漏洞，目前并无其他临时解决方案。思科建议所有运行着低于16.5版本AsyncOS软件的用户尽快升级至16.5.0-780版本。
Cisco's Wednesday advisory includes steps organizations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed - so give that a read if you are unsure. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds. The vendor recommends any customers who are running Cisco AsyncOS Software releases earlier than v 16.5 migrate to 16.5.0-780.
据公告所述，思科于10月份发现该漏洞正遭到恶意利用。这是近两个月内发生的第二起针对思科安全邮件网关系统的零日漏洞攻击事件。今年9月中旬，思科曾提醒用户，攻击者当时也在利用SEG系统中的另一漏洞（编号为CVE-2026-76461）实施攻击，该漏洞同样能让攻击者借助恶意邮件获取系统最高权限。今年1月，攻击者还曾利用AsyncOS系统的另一严重漏洞CVE-2025-20393入侵思科安全邮件网关设备并植入持久化攻击程序；该漏洞最终被评为了满分10级的严重漏洞。
In its alert, Cisco said it became aware of active exploitation in October. This is the second such zero-day in SEG in as many months. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access. In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.®