{
  "id": 14516042,
  "title": "Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability",
  "url": "https://urgent.news/2026/10/14/cisco-warns-of-active-attacks-exploiting-new-critical-secure-email",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T18:38:56.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html"
  },
  "original_language": "en",
  "account": "Cisco has issued a warning about active attacks exploiting a critical vulnerability in its Secure Email Gateway. The flaw allows an attacker to write files to the appliance's operating system without logging in. The vulnerability, tracked as CVE-2026-76519, has a high CVSS score of 9.8. The attack occurs when a crafted email attachment is sent through the gateway. If successful, the attacker can then execute commands as root.\n\nThe Secure Email Gateway filters emails for spam, malware, and other threats. However, only gateways with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 are vulnerable. The fix for this flaw was included in AsyncOS 15.5.5-014 and 16.5.0-780, as well as in Content Scanner Tools version 25.3.0.5525 or later. Cisco discovered the flaw and began contacting customers of its managed Secure Email Cloud service who showed signs of possible compromise. Administrators of those managed gateways may not have the necessary command-line access to check for the compromise, but the fix has been deployed on those gateways.\n\nTo check if the gateway is vulnerable, administrators can enable the File Reputation service and ensure the Content Scanner Tools version is earlier than 25.3.0.5525. If automatic updates are enabled, no action is needed, as the fix will be applied automatically. If automatic updates are disabled, administrators should run the contentscannerupdate command or enable updates under Security Services > Service Updates.\n\nCisco recommends upgrading to AsyncOS 16.5.0-780 or later for gateways earlier than that version. For physical appliances showing signs of compromise, Cisco advises rebuilding the appliance with new credentials. For virtual appliances, Cisco recommends restoring all cluster members that contain at least one compromised appliance. The advisory emphasizes that there is no workaround for this vulnerability.\n\nThis is not the first time Cisco has confirmed a Secure Email Gateway flaw under attack. In September, Cisco disclosed CVE-2026-76461, a SQL injection flaw that could allow an unauthenticated sender to execute commands as root. This flaw, along with the file-write flaw, are both high-severity and affect different parts of the software. Cisco has also updated its hardening release with these two vulnerabilities, and the company has not linked the attacks to any previous exploits.",
  "summary": "Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}