Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Cisco Secure Email Gateway is an appliance that sits in an organization’s email flow. It examines incoming and outgoing messages before they reach users or external recipients. Its job is to filter spam, malware, and other threats. That makes it an important security boundary, but also a valuable target.

The gateway can use Advanced Malware Protection, including the File Reputation service, to inspect attachments. Administrators assign that service to mail policies. Content Scanner Tools support this inspection. In the reported flaw, a specially crafted attachment sent through the gateway could let an unauthenticated sender write files to the appliance’s operating system.

The affected products include physical and virtual Secure Email Gateways on vulnerable AsyncOS releases. Secure Email and Web Manager and Secure Web Appliance are not affected. Administrators should verify the scanner version and install Content Scanner Tools 25.3.0.5525 or later, or use a fixed AsyncOS release.

The flaw allows a sender with no login to write files to the gateway’s operating system. If exploitation succeeds, the attacker could then run commands as root. That turns an email-processing weakness into a possible full compromise of the security appliance.

For example, an attacker could send an email containing a specially crafted attachment through a vulnerable gateway. The flaw is present when File Reputation is enabled and assigned to a mail policy, while Content Scanner Tools is older than version 25.3.0.5525. Cisco tracked the issue as CVE-2026-76519 and gave it a CVSS score of 9.8.

Root is the highest privilege level on the appliance, so commands run with it can affect core files, services, credentials, and security settings. Cisco does not say whether attackers obtained root on any devices. It also does not identify the attackers or disclose how many gateways were attacked.

Exposure depends on two conditions, not simply on owning a Cisco gateway. First, the File Reputation service, part of Advanced Malware Protection, must be enabled and assigned to a mail policy. Second, the Content Scanner Tools package must be earlier than version 25.3.0.5525.

Both physical and virtual Secure Email Gateways on vulnerable AsyncOS releases can be affected. Administrators can inspect File Reputation under the Advanced Malware Protection settings for incoming or outgoing mail policies. They can run contentscannerstatus at the command line to see the scanner version and its last update time.

Secure Email and Web Manager and Secure Web Appliance are not affected by this issue. The scanner update is available for licensed and supported AsyncOS releases. Cisco recommends moving gateways earlier than AsyncOS 16.5 to 16.5.0-780, while 16.0 has no fixed build listed.

The gateway normally receives email and examines attachments for threats. That inspection uses the File Reputation service and Content Scanner Tools. The flaw sits in this processing path. A sender does not need an account or login; the email itself carries the crafted attachment.

A concrete attack involves sending the attachment through a gateway where File Reputation is enabled for a mail policy and the scanner is outdated. If the exploit succeeds, Cisco says the sender can write files to the appliance’s operating system. The attacker could then run commands as root. The advisory does not explain exactly what the attachment contains or which scanner operation fails.

This means email filtering can become the attack route rather than the protection. Cisco became aware of attacks in October after finding the flaw through internal security scanning. Organizations should confirm the scanner version, apply the update, and check every cluster member for compromise.

Administrators should first confirm the scanner version with contentscannerstatus. If it is outdated, they can run contentscannerupdate or enable automatic updates under Security Services. The scanner update installs without an AsyncOS upgrade or restart. Fixed full software releases include 15.5.5-014 and 16.5.0-780; Cisco lists no fixed 16.0 build.

For example, a gateway on an affected release can receive Content Scanner Tools 25.3.0.5525 or later while keeping its current software. If a virtual appliance shows compromise, Cisco says to preserve forensic data, deploy a new virtual machine on a fixed release, rebuild its configuration without importing the old file, and renew credentials and cryptographic material.

Upgrading a compromised virtual appliance destroys its logs and evidence. That can prevent investigators from understanding what happened. Physical appliances should be taken to Cisco Technical Assistance Center, with remote access enabled for investigation. There is no workaround.

Cisco provides a command-line check for attempted exploitation: grep "System Security" system_logs. It can report a suspected compromise, an incomplete security scan, or no compromise indicator. Administrators should run it on every member of a cluster, not just one appliance.

A result saying “Compromise detected” means the customer should follow Cisco’s recovery steps and contact TAC. If the scan did not complete, Cisco also directs administrators to TAC. A clean result says only that this check found no indicator. It does not establish that the gateway was never breached.

An attacker who reached root could remove or hide evidence before the check ran. Cisco therefore recommends reviewing firewall and network logs outside the device for unexpected uploads to external IP addresses or downloads from malicious ones. The advisory does not explain what the local scan searches for.

A software vulnerability is a weakness in code or design that can let an attacker cause unintended effects. A disclosure tells defenders that the weakness exists and may provide affected versions and fixes. A CVE identifier gives the issue a standard tracking name. Here, Cisco identifies the flaw as CVE-2026-76519.

Severity scores help compare potential impact and urgency. Cisco gave this flaw a CVSS score of 9.8, indicating a critical issue. The article also says attackers were exploiting it in October. That combination matters: defenders should prioritize a flaw that is both highly rated and being used against real systems.

Organizations can use these signals to order work: identify affected gateways, verify exposure, apply the scanner or AsyncOS fix, and investigate compromise. The score does not prove an attack occurred on every device. Cisco says it does not know how many devices were attacked or whether attackers obtained root.