Cisco Warns of Active Exploitation of Critical Secure Email Gateway Flaw
Summary
Cisco says attackers are exploiting CVE-2026-76519 in certain Secure Email Gateway configurations to write files and potentially run commands as root. It urges customers to update Content Scanner Tools or install fixed AsyncOS releases.
Key points
- The unauthenticated attack uses a crafted email attachment to write files to the appliance and could enable root command execution.
- A gateway is vulnerable only if File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525.
- Cisco says it became aware of attacks in October but does not disclose the number of devices targeted, the attackers, or whether root access was obtained.
- The scanner update 25.3.0.5525 or later fixes the flaw without a software upgrade or restart; fixed AsyncOS releases include 15.5.5-014 and 16.5.0-780.
- Administrators can check the scanner version with contentscannerstatus and look for attempted exploitation with grep "System Security" system_logs; Cisco cautions that a clean result is not proof of no compromise.
- Cisco recommends rebuilding compromised virtual appliances with new credentials and restoring all cluster members if one is compromised; upgrading a compromised instance destroys forensic data and logs.
- Cisco says this is the second Secure Email Gateway flaw confirmed under attack in a month, and it has not linked the attacks.
Article Details
- Vulnerability Types
- Path traversal
- Unauthenticated file write
- Severity
- Critical; CVSS 9.8
- Affected Versions
- Cisco Content Scanner Tools versions earlier than 25.3.0.5525, when File Reputation is enabled and assigned to a mail policy
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-76461Secure Email Gateway flaw Cisco has confirmed under attack in a month. On September 14 it disclosed CVE-2026-76461, a SQL injection flaw in the gateway's email parsing that could let an unauthenticated sender runCVE-2026-76519Cisco found the flaw, tracked as CVE-2026-76519 (CVSS score: 9.8), in its own internal security scanning and became aware of the attacks in October. The advisory does not say how many devices were attacked, who is
Vendors
Products
AsyncOSThe fix has been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as fixed in a hardening release that day, which the company now says covered this flaw. It also arrives as aCisco Secure Email GatewayAttackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.Content Scanner Toolsmalware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable.File Reputationfilters an organization's email for spam, malware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable.Secure Email CloudCisco has contacted customers of its managed Secure Email Cloud service whose devices showed "indicators of possible compromise" and says it is engaged in remediation and recovery. Administrators of those managed