CISCO has disclosed a critical flaw in its Secure Email Gateway that threat actors have been actively exploiting, tracked as CVE-2026-76519 with a CVSS of 9.8. The vulnerability resides in the Advanced Malware Protection (AMP) feature and stems from improper handling of email attachments when the File Reputation service is enabled.
If the attacker can deliver a crafted email attachment through an affected gateway, they may write arbitrary files to the underlying operating system and execute commands with root privileges. Cisco says the issue was discovered via internal security scanning and that active exploitation was observed in October.
Remediation hinges on a combination of configuration checks and software updates. An affected device requires the File Reputation service to be enabled (and linked to a mail policy) and a Content Scanner Tools version earlier than 25.3.0.5525. Administrators can verify the File Reputation status in the web management interface under Mail Policies, Advanced Malware Protection, or by running contentscannerstatus on the CLI.
If the version is older than 25.3.0.5525, the device is exposed; updating Content Scanner Tools mitigates the risk. Cisco has released fixed AsyncOS versions 15.5.5-014 and 16.5.0-780, and recommends upgrading directly to 16.5.0-780 if on older releases (16.0 has no fixed release). For those using Secure Email Cloud, no action is required.
The advisory also provides guidance for detecting compromises via grep "System Security" system_logs and urges cross-checking external firewall and network logs, as a clean log does not guarantee the device is not compromised. If compromised, rebuild virtual appliances from scratch and rotate credentials and keys.