Cisco Email Gateway Flaw Under Active Attack: Check Your Version Now

Cisco has warned that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway, the appliance that filters an organisation's email for spam, malware and other threats. The flaw, tracked as CVE-2026-76519 (CVSS score: 9.8), lets a sender with no login write files to the appliance's operating system. An attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. Cisco found the flaw in its own internal security scanning and became aware of attacks in October.

Only some gateways are exposed. Both conditions must be true: the File Reputation service, part of the Advanced Malware Protection feature, must be enabled and assigned to a mail policy, and the Content Scanner Tools version must be older than 25.3.0.5525. Physical and virtual gateways on vulnerable AsyncOS releases are affected. Secure Email and Web Manager and Secure Web Appliance are not. The advisory does not say how many devices were attacked, who is behind it, or whether attackers obtained root on any of them.

The fix has been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, and is also available as a Content Scanner Tools update, version 25.3.0.5525 or later, which installs without a software upgrade or restart. Customers of the managed Secure Email Cloud service need no action, as Cisco has already deployed the fixed scanner and has contacted those whose devices showed indicators of possible compromise.