Attackers are actively exploiting a critical vulnerability in Cisco Secure Email Gateway. In an advisory published on Wednesday, Cisco said the flaw lets an unauthenticated sender write files to the appliance’s operating system. The bug is tracked as CVE-2026-76519 and carries a CVSS score of 9.8.
How the Attack Works?
An attacker sends an email with a crafted attachment through the gateway. If the exploit succeeds, the attacker could go on to run commands as root. The gateway sits in front of an organization’s mail flow, filtering spam, malware and other threats, so a compromised appliance is a serious problem.
Cisco says its own internal security scanning found the flaw, and that it learned of attacks in October. The advisory does not say how many devices were hit, who is behind the attacks, or whether any attacker actually gained root access.
For customers of its managed Secure Email Cloud service, Cisco has contacted those whose devices showed “indicators of possible compromise” and says it is working on remediation and recovery. Cisco has already deployed the fixed scanner on managed gateways, so those customers need no action to get the fix.
Who Is Exposed?
A gateway is vulnerable only if both of these conditions are true:
- The File Reputation service, part of the Advanced Malware Protection (AMP) feature that handles attachments, is enabled and assigned to a mail policy.
- The Content Scanner Tools package is older than version 25.3.0.5525.
Both physical and virtual gateways on vulnerable AsyncOS releases are affected. Secure Email and Web Manager and Secure Web Appliance are not.
To check the first condition: go to Mail Policies > Incoming Mail Policies > Advanced Malware Protection (or the same path under Outgoing Mail Policies), choose a mail policy, and look at the Enable File Reputation box.
To check the second: run contentscannerstatus at the command line. It shows the installed version and the time of the last update.
How to Fix It?
The fastest fix is the Content Scanner Tools update, version 25.3.0.5525 or later. It installs without a software upgrade or a restart.
- If automatic updates are on, no action is needed once the update applies. Still, confirm with contentscannerstatus instead of assuming it arrived.
- If automatic updates are off, run contentscannerupdate at the command line, or switch them on under Security Services > Service Updates.
The full AsyncOS fix has been available since September 14. Cisco shipped it in a hardening release that day, and now says that release covered this flaw. The first fixed versions are:
| Release | Fixed build |
|---|---|
| 15.5 | 15.5.5-014 |
| 16.0 | No fixed build. Migrate to a fixed release |
| 16.5 | 16.5.0-780 |
| Content Scanner Tools | 25.3.0.5525 or later |
Cisco recommends that any gateway running a release earlier than 16.5 move to 16.5.0-780. One detail deserves attention: a 16.0 gateway on build 16.0.4-302, which fixed September’s SQL injection flaw, is not fixed for this one. The advisory also does not say which releases count as licensed and supported for the scanner update. For a gateway that stays on 16.0, the scanner version shown by contentscannerstatus is the only confirmation the advisory offers.
There is no workaround.
How to Check for Compromise?
Cisco’s check for attempted exploitation is a single command on the appliance:
grep “System Security” system_logs
It returns one of three messages:
- “Suspected compromise indicator was found. Contact TAC for further recommendations.” A compromise was detected. Follow the recovery steps below.
- “Security scan did not complete. Contact TAC for further recommendations.” Contact Cisco’s Technical Assistance Center (TAC).
- “No compromise indicator was found.” This check found no compromise. Upgrade if the device is on an affected release.
Run the command on every member of a cluster. A clean result is not proof of safety, because an attacker with root access could remove or hide evidence. Administrators should also review firewall and network logs outside the device for unexpected uploads to external IP addresses or downloads from malicious ones. The advisory does not explain what the scan looks for. Administrators of managed gateways may not have the command-line access needed to run this check.
If a Device Is Compromised
For a physical appliance, Cisco asks customers to contact TAC and enable remote access so its engineers can investigate.
For a virtual appliance, the steps are:
- Preserve forensic data first. Upgrading a compromised instance destroys its logs and evidence.
- Deploy a new virtual machine on a fixed release.
- Rebuild the configuration without importing any previous configuration file.
- Renew the credentials and cryptographic material on the appliance, then keep monitoring for unusual behavior.
Cluster members authenticate to each other with SSH key pairs, so a compromised member’s private keys could give an attacker a way into the others. For that reason, Cisco recommends restoring every member of a cluster that contains at least one compromised appliance. Secure Email Cloud customers contacted by Cisco are asked to renew credentials and cryptographic material where possible.
Second Exploited Gateway Flaw in a Month
This is the second Secure Email Gateway flaw Cisco has confirmed as exploited in a month. On September 14, it disclosed CVE-2026-76461, a SQL injection flaw in the gateway’s email parsing. That bug could let an unauthenticated sender run commands as root through a crafted email. It affects every configuration and was added to CISA’s Known Exploited Vulnerabilities catalog the same day. The two flaws sit in different parts of the software and have different log checks, and Cisco has not linked the attacks.
Also on September 14, Cisco published a hardening release for the gateway and for Secure Email and Web Manager. It grouped internally found bugs into five umbrella CVEs by weakness class:
- CVE-2026-76440, CVE-2026-76441, CVE-2026-20353 and CVE-2026-76443, each scored 9.8
- CVE-2026-76442, scored 7.5
Each score reflects the highest-rated bug in its class. Cisco updated that advisory on Wednesday to say that two of the bugs are known to be actively exploited: the file-write flaw, which falls in the path traversal class, and the September SQL injection flaw, which falls in the improper neutralization class. The company says it is not aware of attacks on the other bugs in the release.
This grouping follows a disclosure policy Cisco set out in June, under which bugs fixed in hardening releases share grouped CVEs. A flaw gets its own CVE when, among other reasons, it is known to be exploited. That is why the file-write flaw, fixed in September inside the path traversal group, received its own advisory this week.
