CISCO has warned that active attacks are exploiting a critical vulnerability in its Secure Email Gateway. The flaw, tracked as CVE-2026-76519 (CVSS 9.8), can allow a sender with no login to write files to the appliance’s operating system and, if successful, execute commands as root via a crafted attachment delivered through the gateway.
The vulnerability exists only when two conditions are met: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is older than 25.3.0.5525. Cisco began shipping fixes on 14 September in AsyncOS 15.5.5-014 and 16.5.0-780, with the scanner update 25.3.0.5525 or later installed without requiring a software upgrade or restart. The company says it is aware of attacks in October but did not specify affected device counts or origins.
The issue affects physical and virtual Secure Email Gateways on vulnerable AsyncOS releases; Secure Email Web Manager and Secure Web Appliance are not affected. To check exposure, administrators should verify that File Reputation is enabled under the relevant mail policy (Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection) and run contentscannerstatus to confirm the Content Scanner Tools version is 25.3.0.5525 or newer.
If compromise is suspected, Cisco’s guidance includes preserving forensic data, upgrading to fixed releases (preferably 16.5.0-780 or later; 15.5 users should move to a fixed release), and renewing credentials and cryptographic material. A rebuild of compromised virtual appliances is advised, as upgrading can destroy logs and forensic evidence. Cisco linked this to a broader pattern of actively exploited vulnerabilities in the same product line, including CVE-2026-76461 from September.