Cisco Warns of Active Exploitation of Critical Secure Email Gateway Flaw
Summary
Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to write files and run commands as root. Customers should patch; CISA added the flaw to its KEV catalog.
Key points
- The flaw affects the AMP feature when file reputation is enabled and Content Scanner Tools is earlier than 25.3.0.5525.
- Crafted email attachments can let unauthenticated remote attackers write arbitrary OS files and execute commands with root privileges.
- Cisco became aware of active exploitation in October 2026 and warns attackers may hide or remove evidence.
- Cisco released fixes on September 14 in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780; customers should migrate to a patched AsyncOS release.
- Cisco recommends checking external network and firewall logs for suspicious transfers and provides remediation guidance for physical and virtual appliances.
- CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog, with a federal agency patch deadline of October 17.
Article Details
- Vulnerability Types
- Arbitrary file write
- Command execution with root privileges
- Severity
- Critical (CVSS 9.8/10)
- Affected Versions
- Content Scanner Tools versions earlier than 25.3.0.5525
- Secure Email Gateway version 15.5.5-014
- Secure Email Gateway version 16.5.0-780
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For virtual appliances, deploy a new VM running a fixed software release, rebuild the product configuration from scratch, and rotate credentials while preserving forensic evidence.
MITRE ATT&CK
CVE
CVE-2026-76461the second Cisco Secure Email Gateway vulnerability exploited in the wild since mid-September, after CVE-2026-76461, another unauthenticated bug that could lead to command execution with root privileges.CVE-2026-76519Tracked as CVE-2026-76519 (CVSS score of 9.8/10), the security defect impacts the Advanced Malware Protection (AMP) feature of the appliance and could allow remote, unauthenticated attackers to write arbitrary files on
Vendors
Products
Advanced Malware Protection (AMP)Tracked as CVE-2026-76519 (CVSS score of 9.8/10), the security defect impacts the Advanced Malware Protection (AMP) feature of the appliance and could allow remote, unauthenticated attackers to write arbitrary files onAsyncOSCisco customers should migrate to a patched AsyncOS software release as soon as possible.Cisco Secure Email Cloud“Cisco has directly contacted customers who own Cisco Secure Email Cloud devices where indicators of possible compromise were identified.Secure Email GatewayCisco on Wednesday warned customers that hackers have been exploiting a critical-severity vulnerability in Secure Email Gateway.