Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.
The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable.
The fix has been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as fixed in a hardening release that day, which the company now says covered this flaw. It also arrives as a Content Scanner Tools update, version 25.3.0.5525 or later, which installs without a software upgrade or a restart.
Cisco found the flaw, tracked as CVE-2026-76519 (CVSS score: 9.8), in its own internal security scanning and became aware of the attacks in October. The advisory does not say how many devices were attacked, who is behind the attacks, or whether the attackers obtained root on any of them.
Cisco has contacted customers of its managed Secure Email Cloud service whose devices showed "indicators of possible compromise" and says it is engaged in remediation and recovery. Administrators of those managed gateways may not have the command-line access needed to run the compromise check below, and Cisco has already deployed the fixed scanner there, so they need no action to get the fix.
Who Is Exposed
Both conditions must hold. The File Reputation service, part of the Advanced Malware Protection (AMP) feature that handles attachments, must be enabled and assigned to a mail policy, and the Content Scanner Tools version must be earlier than 25.3.0.5525.
Physical and virtual gateways on vulnerable AsyncOS releases are affected. Secure Email and Web Manager and Secure Web Appliance are not.
To check the first condition, open Mail Policies > Incoming Mail Policies > Advanced Malware Protection, or the same path under Outgoing Mail Policies, choose a mail policy, and look at the Enable File Reputation box. To check the second, run contentscannerstatus at the CLI, which shows the version and when it was last updated.
How to Fix It
The quickest route is the scanner update. Gateways with automatic Content Scanner Tools updates turned on need no action once the update has applied, so confirm with contentscannerstatus that the version is 25.3.0.5525 or later rather than assuming it arrived.
Where automatic updates are off, run contentscannerupdate at the CLI, or turn them on under Security Services > Service Updates.
The full AsyncOS fix is in these first fixed releases:
- 15.5: 15.5.5-014
- 16.0: no fixed build. Migrate to a fixed release.
- 16.5: 16.5.0-780
- Content Scanner Tools (all licensed and supported AsyncOS releases): 25.3.0.5525 or later
Cisco recommends that any gateway earlier than 16.5 move to 16.5.0-780. A 16.0 gateway on 16.0.4-302, the build that fixed September's SQL injection flaw, is not fixed for this one, and the advisory does not list which releases count as licensed and supported for the scanner update. For a 16.0 gateway that stays on 16.0, the scanner version shown by contentscannerstatus is the only confirmation the advisory offers.
There is no workaround. For a virtual appliance that shows signs of compromise, Cisco's guidance is a rebuild with new credentials, and it warns that upgrading a compromised instance destroys the forensic data and logs.
How to Check for Compromise
Cisco's check for attempted exploitation is one command on the appliance: grep "System Security" system_logs. It returns one of three messages:
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.Compromise detected. Follow the recovery steps below.System Security: Security scan did not complete. Contact TAC for further recommendations.Contact Cisco's Technical Assistance Center (TAC).System Security: No compromise indicator was found.No compromise detected by this check. Upgrade if the device is on an affected release.
Run it on every member of a cluster. A clean result is not proof: an attacker with root could remove or hide evidence, so also check firewall and network logs outside the device for unexpected uploads to external IP addresses or downloads from malicious ones. The advisory does not say what the scan looks for.
If a Device Is Compromised
For a physical appliance, Cisco asks customers to contact TAC and to enable remote access so its engineers can investigate. For a virtual appliance, its steps are:
- Preserve forensic data first. Upgrading a compromised instance destroys its logs and evidence.
- Deploy a new virtual machine on a fixed release.
- Rebuild the configuration without importing any previous configuration file.
- Renew the credentials and cryptographic material on the appliance, then keep monitoring for unusual behavior.
Cluster members authenticate to each other with SSH key pairs. A compromised member's private keys could give the attacker a way into the others, so Cisco recommends restoring every member of a cluster that contains at least one compromised appliance. Secure Email Cloud customers it has contacted are asked to renew credentials and cryptographic material where possible.
The September Release
This is the second Secure Email Gateway flaw Cisco has confirmed under attack in a month. On September 14 it disclosed CVE-2026-76461, a SQL injection flaw in the gateway's email parsing that could let an unauthenticated sender run commands as root through a crafted email.
That flaw affects every configuration and was added to CISA's Known Exploited Vulnerabilities catalog the same day. The two flaws sit in different parts of the software and have different log checks, and Cisco has not linked the attacks.
The same day, Cisco published a hardening release for the gateway and for Secure Email and Web Manager that grouped internally found bugs into five umbrella CVEs by weakness class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, each scored 9.8, and CVE-2026-76442 at 7.5. Each score is the highest among the bugs in that class, and the advisory carried the 15.5.5-014 and 16.5.0-780 builds.
Cisco updated that advisory on Wednesday, and it now says "Two of them are known to be actively exploited": the file-write flaw, which sits in the path traversal class, and the September SQL injection flaw, which sits in the improper neutralization class. It is not aware of attacks on the other bugs in the release.
Under a disclosure policy Cisco set out in June, bugs fixed in hardening releases share grouped CVEs, and a flaw gets its own CVE when, among other reasons, it is known to be exploited. The file-write flaw was fixed in September inside the path traversal group and received its own advisory on Wednesday.
It is also the third root-level flaw in these appliances that Cisco has confirmed exploited since December, when a China-linked group that Cisco Talos tracks as UAT-9686 used a zero-day in the spam quarantine feature, CVE-2025-20393, that Cisco patched in January.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.