Cisco warns of critical vulnerability on Secure Email Gateway exploited in the wild

Cisco has issued a security advisory regarding a critical vulnerability affecting the Secure Email Gateway. The flaw, tracked as CVE-2026-76519, is being actively exploited in the wild. According to the advisory, attackers can send specially crafted email attachments through the gateway to write files onto the device's operating system and execute commands with root privileges without authentication. The vulnerability carries a CVSS score of 9.8. Cisco's internal security scanning discovered the flaw, and real-world attacks were observed in October 2026. The vulnerability impacts physical and virtual gateways running AsyncOS. The issue is limited to devices where the File Reputation service, part of Advanced Malware Protection, is enabled and linked to a mail policy, and where the Content Scanner Tools version is below 25.3.0.5525. Cisco has not disclosed the number of affected devices, the threat actor group, or whether root access has already been obtained on any device. The fastest mitigation is updating Content Scanner Tools to version 25.3.0.5525 or higher. This update can be installed without a software upgrade or device restart.

Administrators can check the version using the contentscannerstatus command and, if automatic update is disabled, run contentscannerupdate via CLI. For AsyncOS level fixes, Cisco included corrections starting 14 September 2026 in AsyncOS 15.5.5-014 and 16.5.0-780, released with a hardening update. AsyncOS 16.0 has no fixed build; version 16.0.4-302 does not address this issue. Cisco recommends moving all devices running versions below 16.5 to 16.5.0-780. This vulnerability has no workaround. Customers of the Secure Email Cloud managed service already have the fixed scanner installed, and Cisco is contacting customers showing signs of compromise. Detection of compromise can be attempted via the grep "System Security" system_logs command on all cluster devices. However, the absence of abnormal results does not confirm safety, as an attacker with root access may have already removed traces. Administrators should additionally check firewall and network logs for unusual external IP uploads or downloads. If a virtual appliance is compromised, Cisco recommends collecting forensic data before upgrading, as the upgrade will destroy logs and evidence.