Cisco Secure Email Gateway flaw CVE-2026-76519 exploited for root-level access

Cisco disclosed CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway, on 14 October 2026 and says it is being actively exploited. An unauthenticated remote attacker can write arbitrary files to the appliance's operating system by sending an email with a crafted attachment, and successful exploitation can lead to commands running with root privileges.

What is the vulnerability? #

The flaw is in how the gateway handles attachments when file reputation is enabled. Cisco rates it 9.8 out of 10 (CWE-23, relative path traversal). Cisco found it during internal security scanning and says its product security team became aware of active exploitation in October 2026.

An appliance is vulnerable only if both conditions are true:

• The File Reputation service, part of Cisco Advanced Malware Protection, is enabled and assigned to a mail policy.
• The Content Scanner Tools version is earlier than 25.3.0.5525.

Physical and virtual gateways on a vulnerable AsyncOS release are affected. Cisco says Secure Email and Web Manager and Secure Web Appliance are not.

Which versions fix it? #

Content Scanner Tools 25.3.0.5525 or later also contains the fix, and Cisco says it can be applied without a software upgrade or restart. Cisco says there are no workarounds.

Is this connected to earlier Cisco email flaws? #

Cisco's updated September hardening advisory now says two flaws are known to be actively exploited: this file-write flaw and CVE-2026-76461, an SQL injection flaw disclosed on 14 September, The Hacker News reported. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on 14 September.

Cisco has not said how many appliances were attacked or who is behind the attacks.

How can administrators check for compromise? #

Cisco advises running this command on each appliance, including every cluster member:

grep "System Security" system_logs

The output shows one of three results: a suspected compromise indicator, a scan that did not complete (contact Cisco TAC), or no compromise indicator found. Because an attacker with root access can hide evidence, Cisco also recommends checking network and firewall logs for unexpected uploads to external IP addresses or downloads from malicious ones.

What should email security teams do? #

1. Check whether File Reputation is enabled on your mail policies and which Content Scanner Tools version you run.
2. Update Content Scanner Tools to 25.3.0.5525 or later, or upgrade AsyncOS to a fixed release.
3. Run the compromise check above and review network logs before and after patching.
4. If you find signs of compromise, follow Cisco's recovery guidance. For virtual appliances, The Hacker News reports Cisco advises rebuilding on a fixed release with new credentials, because upgrading a compromised instance destroys forensic data.