Cisco Warns of Active Attacks Exploiting Critical Secure Email Gateway Flaw

Active Exploitation of CVE-2026-76519

Cisco has warned that attackers are actively exploiting a critical vulnerability, tracked as CVE-2026-76519 with a CVSS score of 9.8, in its Secure Email Gateway. The flaw allows an unauthenticated sender to write files to the appliance's operating system by sending a crafted email attachment through the gateway, and could ultimately allow command execution as root. Cisco discovered the flaw through internal security scanning and became aware of the attacks in October. The advisory does not disclose how many devices were attacked, who is behind the attacks, or whether attackers obtained root access on any of them. Cisco has contacted customers of its managed Secure Email Cloud service whose devices showed indicators of possible compromise and says it is engaged in remediation and recovery.

Exposure and Remediation

Two conditions must both hold for a gateway to be vulnerable: the File Reputation service, part of the Advanced Malware Protection feature, must be enabled and assigned to a mail policy, and the Content Scanner Tools package must be older than version 25.3.0.5525. Physical and virtual gateways on affected AsyncOS releases are exposed, while Secure Email and Web Manager and Secure Web Appliance are not. The quickest fix is the Content Scanner Tools update to version 25.3.0.5525 or later, which installs without a software upgrade or restart. The full AsyncOS fix is available in releases 15.5.5-014 and 16.5.0-780, which Cisco shipped on September 14 as part of a hardening release. Cisco recommends that gateways earlier than 16.5 migrate to 16.5.0-780. There is no workaround.

Checking for Compromise

Cisco provides a single command to check for attempted exploitation: grep "System Security" system_logs. The command returns one of four messages indicating whether a compromise indicator was found, whether the scan completed, or whether no indicator was detected. A clean result is not proof of safety, as an attacker with root could remove or hide evidence. Cisco also recommends checking firewall and network logs outside the device for unexpected uploads or downloads. For virtual appliances showing signs of compromise, Cisco advises rebuilding with new credentials and warns that upgrading a compromised instance destroys forensic data and logs. Cluster members authenticate via SSH key pairs, so Cisco recommends restoring every member of a cluster containing at least one compromised appliance.

Second Exploited Flaw in a Month

This is the second Secure Email Gateway flaw Cisco has confirmed under attack in a month. On September 14, the company disclosed CVE-2026-76461, a SQL injection flaw in email parsing that could also allow an unauthenticated sender to run commands as root. That flaw affects every configuration and was added to CISA's Known Exploited Vulnerabilities catalog the same day. The two flaws sit in different parts of the software and Cisco has not linked the attacks. The September hardening release grouped internally found bugs into five umbrella CVEs by weakness class, and Cisco updated that advisory on Wednesday to state that two of them are known to be actively exploited. This is also the third root-level flaw in these appliances that Cisco has confirmed exploited since December, when a China-linked group tracked as UAT-9686 used a zero-day in the spam quarantine feature, CVE-2025-20393.

Sources: The Hacker News