Cisco Secure Email Gateway CVE-2026-76519: One Crafted Attachment Reaches Root

An unauthenticated remote attacker can write arbitrary files to a Cisco Secure Email Gateway and run commands as root by sending an email with a crafted attachment, according to Cisco's advisory for CVE-2026-76519. The gateway must have File Reputation enabled on a mail policy and run Content Scanner Tools earlier than 25.3.0.5525.

Cisco says its product security team learned of active exploitation in October 2026 and that it found the flaw through internal security scanning. It gives the score as 9.8, rated Critical.

Who is exposed

The bug is a relative path traversal in the Advanced Malware Protection feature, triggered by how the gateway handles an attachment. Physical and virtual Secure Email Gateway appliances are affected. Cisco says Secure Email and Web Manager and Secure Web Appliance are not.

The score understates how awkward this is to defend. The attack travels through the mail the gateway exists to receive, so shutting the admin interface off from the internet does nothing. The preconditions are narrow, but they are conditions of configuration, not of attacker access.

Admins can check the scanner version with the contentscannerstatus command. The File Reputation setting sits under Advanced Malware Protection in the incoming or outgoing mail policy, per BleepingComputer.

The fix and its limits

Content Scanner Tools 25.3.0.5525 and later contain the fix, and the update needs no restart. Cisco also lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases, and recommends that anything older than 16.5 move to 16.5.0-780. The advisory lists no workaround.

Item	Detail
Fixed scanner	Content Scanner Tools 25.3.0.5525 or later
Fixed AsyncOS	15.5.5-014, 16.5.0-780
Workaround	None
Federal deadline	October 17, 2026

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 14, 2026, in a batch of four that also held a PAN-OS bug and two AhsayCBS flaws. The catalog gives federal civilian agencies until October 17.

Checking for compromise

Cisco published indicators of compromise. The check is to run grep "System Security" system_logs on the appliance. The output reports one of three results: a suspected compromise indicator, a scan that did not complete, or no indicator found. For the first, Cisco says to follow the recommendations in the advisory. For the second, it says to contact its support centre. For the third, it says to upgrade to a fixed release.

Because an attacker with root can erase evidence, BleepingComputer reports that Cisco also advises reviewing firewall and network logs for suspicious downloads and uploads to or from external addresses.

For a suspected compromise on a virtual appliance, Cisco says to preserve forensic data first, then deploy a new virtual machine on a fixed release, rebuild the configuration without importing old files and rotate credentials and cryptographic material. In a cluster, SSH keys may be exposed, so every member must be restored if one is compromised.

How many devices, and what came before

Cisco has not shared details of the attacks or a count of affected devices. It says it deployed mitigations on Cisco Secure Email Cloud and contacted customers where it found indicators of compromise.

BleepingComputer cites Shadowserver tracking nearly 300 internet-exposed gateway instances, and notes the figure does not separate honeypots or already-secured devices.

The same outlet places this flaw in a run of AsyncOS problems: CVE-2025-20393, a maximum-severity bug patched in January 2026 and exploited as a zero-day against these products since November 2025, and CVE-2026-76461, an email parsing flaw that allows unauthenticated root command execution, which Cisco warned about in September. CISA has added 100 Cisco vulnerabilities to its catalog since November 2021, seven of them used in ransomware attacks, according to the same report.

Other edge products are in the same catalog this week. The Ivanti Connect Secure zero-day entered it on October 13, the same day as a Windows Shell flaw from Microsoft's October Patch Tuesday. Operators of these gateways should install Content Scanner Tools 25.3.0.5525 and run the log check before anything else.