Cisco Patches Actively Exploited Secure Email Gateway Flaw Enabling Root Access

Summary

Cisco says attackers are exploiting CVE-2026-76519, a flaw that can give unauthenticated attackers root access to vulnerable Secure Email Gateway appliances. Cisco has issued fixes and recommends updating and checking for compromise.

Key points

The flaw affects Cisco Secure Email Gateway appliances when File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525.
A specially crafted email attachment can exploit the relative path traversal flaw without authentication or recipient interaction, allowing arbitrary file writes and root-level command execution.
Cisco confirmed active exploitation but has not disclosed the attackers, number of compromised appliances, or post-compromise activity.
Cisco says fixed AsyncOS releases include 15.5.5-014 and 16.5.0-780; Content Scanner Tools 25.3.0.5525 or later also fixes the issue. No workaround fully addresses it.
Cisco recommends running its System Security compromise scan on each appliance and reviewing external network and firewall telemetry; a clean local scan cannot rule out compromise.
For potentially compromised virtual appliances, Cisco recommends preserving forensic evidence and rebuilding with fixed software rather than upgrading in place; credentials and cryptographic materials should be renewed.