Photo credits
Cisco Secure Email Gateway Vulnerability Exposed, Patching Urged
A critical flaw in Cisco’s Secure Email Gateway allows attackers to gain root access through crafted email attachments, and Cisco is urging customers to update software and check logs for signs of compromise.
15 Oct 2026 0 reads Compiled with AI
#Cisco #Secure Email Gateway #CVE-2026-76519
Cisco has confirmed that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway, identified as CVE-2026-76519 and given a CVSS score of 9.8. The flaw lets an unauthenticated attacker send a specially crafted email attachment that can write arbitrary files on the appliance’s operating system, giving root‑level access. Both Security Affairs and SecurityWeek reported that the exploitation began in October 2026.
The defect is tied to the Advanced Malware Protection (AMP) feature. It occurs only when the File Reputation service is turned on and the Content Scanner Tools version is older than 25.3.0.5525. When those conditions are met, an email with a malicious attachment can trigger the flaw, allowing the attacker to create files and run commands with root privileges.
Cisco’s advisory lists the simplest remediation: update the Content Scanner Tools package, which does not require a full software upgrade or a device restart. Patches were released for AsyncOS 15.5.5‑014 and 16.5.0‑780. Appliances running AsyncOS 16.0 must migrate to a newer version. Cisco‑managed Secure Email Cloud customers are already protected and need no action.
Cisco recommends a multi‑step detection process. Run the built‑in compromise check command, then review the device’s network and firewall logs for unexpected uploads or downloads to external IP addresses. If a virtual appliance is suspected of compromise, rebuild the system from a fixed software release, reconfigure from scratch, and rotate all credentials and keys while preserving forensic evidence.
This vulnerability is the second Secure Email Gateway flaw that has been exploited in the wild since mid‑September, following CVE‑2026‑76461. The U.S. Cybersecurity and Infrastructure Security Agency added CVE‑2026‑76519 to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch by October 17. Cisco has also identified a third earlier flaw that attackers have used to gain root access.