Cisco says attackers are exploiting CVE-2026-76519, a critical flaw in the attachment-processing path of Secure Email Gateway. An unauthenticated attacker can send a crafted email through an affected appliance and potentially write arbitrary files to its operating system. Cisco says a successful exploit can lead to command execution with root privileges. Its October 14 advisory assigns the issue a CVSS score of 9.8 and confirms that its incident-response team became aware of active exploitation in October.
Which gateways are exposed?
The vulnerable configuration has two specific conditions: the File Reputation service in Cisco Advanced Malware Protection must be enabled and assigned to a mail policy, and the appliance must run a Content Scanner Tools version earlier than 25.3.0.5525 alongside a vulnerable AsyncOS release. Cisco identifies physical and virtual Secure Email Gateway appliances as potentially affected. It says Secure Email and Web Manager and Secure Web Appliance are not affected by this issue. Administrators should check the actual mail policy and component version, rather than infer exposure from the product name alone.
The attack route is notable because the malicious input is an email attachment, precisely the material the gateway is built to inspect. The advisory describes a possible chain from crafted attachment to arbitrary file write and root-level execution; it does not provide a public tally of compromised organizations. Cisco says it has contacted Secure Email Cloud customers on whose devices it detected malicious activity. The vendor's statement confirms active attacks but should not be read as evidence that every vulnerable gateway was compromised.
Patch and investigate
Cisco lists fixed AsyncOS releases including 15.5.5-014 and 16.5.0-780; operators on 16.0 should move to a fixed release. The company also distributes the fix through Content Scanner Tools 25.3.0.5525 or later for licensed, supported releases. That component update does not require a product restart, according to Cisco. Administrators should compare their exact branch and scanner version with the current fixed-software table and verify that automatic scanner updates have actually been applied. Cisco says there is no workaround that addresses the vulnerability.
For possible compromise, Cisco recommends examining system_logs for its System Security messages and checking every member of a cluster. It also advises cross-checking network and firewall logs outside the gateway: an attacker with root access could remove or conceal local evidence. If exploitation is suspected, preserve forensic material before rebuilding a virtual appliance or replacing credentials and cryptographic material. Cisco's advisory provides separate recovery guidance for physical and virtual devices.
Updating is the immediate preventive step. Where indicators or unusual traffic suggest a successful intrusion, the gateway should be treated as an incident-response subject, not simply as a device awaiting a patch.