Cisco Warns of Exploited Secure Email Gateway Vulnerability

CVE-2026-76519 is a critical-severity vulnerability (CVSS 9.8) in Cisco Secure Email Gateway's Advanced Malware Protection feature. It allows unauthenticated remote attackers to send crafted email attachments that exploit a flaw in the handling of attachments when the file reputation service is enabled and Content Scanner Tools is below version 25.3.0.5525. Exploitation enables arbitrary file writes and command execution with root privileges on the underlying operating system. Cisco became aware of active exploitation in October 2026 and has released patches in AsyncOS versions 15.5.5-014 and 16.5.0-780. Cisco has also provided indicators of compromise and remediation guidance, including rebuilding virtual appliances and rotating credentials. The US CISA has listed this vulnerability in its KEV catalog, emphasizing the urgency of patching.

Successful exploitation grants attackers root-level command execution on affected Cisco Secure Email Gateway devices, enabling arbitrary file writes and potentially full system compromise. Attackers may also remove or hide evidence of exploitation, complicating detection and forensic analysis. The vulnerability is actively exploited in the wild, increasing the risk to organizations using vulnerable versions of the product.

Cisco has released official patches in AsyncOS versions 15.5.5-014 and 16.5.0-780; customers should upgrade to these versions immediately. For virtual appliances, Cisco recommends deploying new VMs with the fixed software, rebuilding configurations from scratch, and rotating credentials while preserving forensic evidence. Cisco manages remediation for cloud-hosted Secure Email Gateway devices and has deployed mitigations under its control. Organizations should review network and firewall logs for suspicious activity and contact Cisco TAC if exploitation is suspected. The US CISA urges patching by October 17, 2026.