Cisco Secure Email Gateway Under Active Attack: CVE-2026-76519 Lets Attackers Run Commands as Root
Cisco confirms CVE-2026-76519 is exploited in Secure Email Gateway. A crafted attachment can give root access. Patch and check for compromise.
Vulnerabilities
Cisco ASA and FTD Under Active Attack: Unauthenticated Flaw Knocks Out VPN Access (CVE-2026-76418)
Cisco confirms active exploitation of CVE-2026-76418: a crafted request can reload ASA and FTD firewalls without authentication. Patches are available.
Cisco has confirmed active exploitation of CVE-2026-76418 in its Secure Firewall ASA and FTD software. The flaw allows a remote, unauthenticated attacker to force the device to reload, disrupting the services that depend on it. Cisco published its advisory and fix information on October 28.
What happened
The issue lies in how the software handles SSL VPN remote access. Tenable also notes that a specially crafted connection request can trigger a denial-of-service condition. Cisco says it became aware of active exploitation of the vulnerability in October.
For organizations running these firewalls, the practical risk is lost connectivity. When assessing the potential impact, factor in remote employees and any business services that rely on the device.
Who is affected
According to Cisco, the vulnerability is only exploitable in a specific configuration: the device must be running a vulnerable software release, expose the SSL VPN login service, and have secondary authentication configured on the relevant tunnel group. Simply running ASA or FTD does not, by itself, mean a device is vulnerable.
Administrators should compare their actual configuration against the conditions described in the advisory. Standby and failover devices should be reviewed as well, so that a traffic failover does not land you back on a vulnerable installation.
What to do now
- Identify the software version and check it against the vulnerability conditions in Cisco’s advisory.
- Select the fixed release for your product train using Cisco’s table or the Cisco Software Checker.
- Plan the upgrade with downtime in mind and make sure you can roll back to a known-good configuration.
- After deployment, verify that the VPN works, users can log in, and the device is healthy.
- Review the history of unexpected reloads and events on the VPN interface. Treat them as leads for further analysis, not as standalone proof of an attack.
SecurHUB commentary
With an actively exploited vulnerability, what matters is quickly identifying which devices meet the conditions for exploitation. An infrastructure security audit can help verify your remote access configuration and set clear priorities for patching.
