Critical Cisco Secure Email Gateway Vulnerability CVE-2026-76519 Actively Exploited in the Wild

TL;DR

Cisco disclosed CVE-2026-76519, a critical arbitrary file write flaw in the Cisco Secure Email Gateway. Attackers are actively exploiting this flaw in the wild. Rated 9.8 on the CVSS 3.1 scale, this Cisco Secure Email Gateway vulnerability lets unauthenticated remote attackers execute commands with root privileges. Therefore, administrators must update the Content Scanner Tools package. Alternatively, teams can upgrade Cisco AsyncOS Software immediately.

Why CVE-2026-76519 Matters for Enterprise Defenders

Enterprise organizations deploy physical, virtual, and cloud-based email gateways to inspect inbound and outbound mail traffic. However, according to the official Cisco Security Advisory, “in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Furthermore, Cisco directly contacted Cisco Secure Email Cloud customers after identifying malicious activity on their appliances. Because root access lets attackers erase local logs, they can steal private SSH keys shared across clusters. As a result, a single compromised node exposes the entire cluster. Currently, no public proof-of-concept exploit code has been confirmed.

How the Cisco Secure Email Gateway Attack Works

AMP File Reputation Attachment Handling Flaw

Tracked internally as Cisco Bug ID CSCwu56223, the flaw resides in the Advanced Malware Protection (AMP) feature. Specifically, the advisory states that “this vulnerability is due to improper handling of email attachments when the file reputation service is enabled.” Consequently, an unauthenticated remote attacker can trigger the flaw simply by sending an email with a crafted attachment through an affected device. As Cisco explains, “a successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.”

Affected Products and Versions

While Secure Email and Web Manager and Secure Web Appliance are unaffected, physical and virtual Cisco Secure Email Gateway appliances are vulnerable when two conditions are met:

• The AMP File Reputation service is enabled and assigned to an incoming or outgoing mail policy.
• The Content Scanner Tools version is earlier than 25.3.0.5525 across Cisco AsyncOS Software branches 13.0, 13.5, 14.0, 14.2, 14.3, 15.0, 15.5, 16.0, and 16.5.

Patch Details and Mitigation Steps

Because “there are no workarounds that address this vulnerability,” administrators should apply Content Scanner Tools version 25.3.0.5525 or later using the contentscannerupdate CLI command. Updating Content Scanner Tools does not require a system restart. Cisco Secure Email Cloud Gateway instances are already patched. Additionally, teams can upgrade Cisco AsyncOS Software to fixed releases 15.5.5-014 or 16.5.0-780. Finally, administrators should run grep "System Security" system_logs to check for compromise indicators. They should also inspect external firewall logs. Furthermore, they should rebuild any compromised virtual or clustered appliances.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.