Cisco Warns of Actively Exploited Critical Flaw in Secure Email Gateway

Cisco on October 14 published an advisory for a critical vulnerability in its Secure Email Gateway appliances, and said its product security team has become aware of active exploitation in the wild.

The flaw, tracked as CVE-2026-76519, carries a CVSS 3.1 base score of 9.8 out of 10. Cisco classifies it as an arbitrary file write weakness (CWE-23). An unauthenticated remote attacker can trigger it by sending an email with a specially crafted attachment, which can allow files to be written to the device and commands to be run with root privileges.

Who is affected

The advisory covers physical and virtual Secure Email Gateway appliances running a vulnerable AsyncOS release. Exposure depends on configuration:

• The File Reputation service, part of Cisco's Advanced Malware Protection, must be enabled and assigned to a mail policy
• The Content Scanner Tools version must be earlier than 25.3.0.5525

Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected.

Fixes

Cisco states that no workaround addresses the vulnerability, so customers need to update.

• AsyncOS 15.5: fixed in 15.5.5-014
• AsyncOS 16.5: fixed in 16.5.0-780
• AsyncOS 16.0: customers should migrate to a fixed release
• Content Scanner Tools 25.3.0.5525 or later also contains the fix and can be installed without a full software upgrade or restart

Context

Email gateways sit at the edge of corporate networks and process untrusted input by design, which makes them frequent targets. Cisco's advisory does not describe who is exploiting the flaw or how many customers have been affected. Administrators who run the affected configuration should check their Content Scanner Tools version and apply the update as soon as possible.