Cisco Secure Email Gateway Under Active Attack: CVE-2026-76519 Lets Attackers Run Commands as Root

Cisco has confirmed active exploitation of CVE-2026-76519 in Secure Email Gateway. An email with a crafted attachment can let an attacker write files and run commands with root privileges, without logging in. Cisco published a separate advisory on October 14 at 16:00 UTC (6:00 p.m. Polish time).

What happened

The flaw is in how the Advanced Malware Protection feature handles attachments. Cisco learned of the attacks in October but has not said how widespread they are or who is behind them. The vulnerability has a CVSS score of 9.8.

Physical and virtual gateways are at risk when two conditions are both true: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools package is older than version 25.3.0.5525.

What’s new is that Cisco has now publicly confirmed the attacks and given the flaw its own identifier. The fix itself already shipped in September’s security hardening releases. That means you can’t judge a device’s status just from the date it was last updated.

What to do now

• Check the package version with the contentscannerstatus command, and check the File Reputation setting in your mail policies.
• Confirm that Content Scanner Tools 25.3.0.5525 or later is installed. If automatic updates are turned off, run contentscannerupdate. Updating this package does not require a reboot.
• Check AsyncOS as well. The fixed releases are 15.5.5-014 and 16.5.0-780. For the 16.0 branch, Cisco recommends migrating.
• Review the “System Security” messages in the system_logs log on every device in the cluster. Compare them with network and firewall logs collected outside the gateway, because an attacker with root privileges can delete traces.
• If you suspect a compromise, preserve the evidence so it can’t be altered, then follow Cisco’s recovery procedure. Updating a compromised virtual machine can destroy the logs you need for the investigation.

Installing the patch and investigating a possible earlier breach are two separate tasks. For physical devices suspected of compromise, Cisco recommends contacting TAC support. For virtual devices, it recommends rebuilding the environment and rotating credentials.

SecurHUB commentary

An email gateway needs the same security oversight as every other system that handles company mail. If there are signs of compromise, incident response should include preserving evidence and working out how much access the attacker had.

Sources: Cisco, BleepingComputer, The Hacker News