Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco has issued an advisory regarding a critical flaw in its Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. According to The Hacker News, unauthenticated attackers can exploit the vulnerability by sending an email with a crafted attachment through the gateway. If successful, an attacker could write arbitrary files to the appliance's operating system and execute commands with root privileges.

SecurityWeek also notes that unauthenticated, remote attackers could use this method to write files and execute commands with root privileges.

The vulnerability affects appliances with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525. Cisco identified the flaw through internal security scanning and became aware of active attacks in October, though the company has not specified the number of affected devices or the identity of the attackers.

For customers using the managed Secure Email Cloud service, Cisco has contacted those whose devices showed indicators of possible compromise to engage in remediation and recovery.

Fixes for the flaw have been available since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780. The Hacker News reports that the issue can also be resolved via a Content Scanner Tools update, version 25.3.0.5525 or later, which can be installed without a software upgrade or a system restart.

Brief written by urgent.news from SecurityWeek, The Hacker News — 2 reports on this story. Machine-written — may contain errors; check the original before relying on it.