Cisco Secure Email Gateway CVE-2026-76519 exploited: crafted email attachment gives attackers root; fixes available
Cisco Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) is being exploited. A crafted email attachment can give an unauthenticated attacker root. Fixes exist (15.5.5-014, 16.5.0-780, or Content Scanner Tools 25.3.0.5525). Businesses running the gateway should update now.
Nothing for most families, as this is business equipment. If you or a family office run a Cisco Secure Email Gateway, update to 15.5.5-014 or 16.5.0-780, or apply Content Scanner Tools 25.3.0.5525 or later, and ask your IT provider to check for signs of compromise.
What’s happening
Cisco has fixed a critical flaw, CVE-2026-76519, in Cisco Secure Email Gateway, the appliance some organisations use to filter email. An attacker with no login can send an email with a crafted attachment and write files to the device's operating system, which Cisco says can lead to commands running as root. Only gateways with File Reputation (part of Advanced Malware Protection) switched on and assigned to a mail policy, and with Content Scanner Tools older than 25.3.0.5525, are affected. Secure Email and Web Manager and Secure Web Appliance are not. Cisco says attackers are exploiting it and found it through its own internal scanning. There is no workaround. Fixes are AsyncOS 15.5.5-014 and 16.5.0-780; for 16.0 Cisco says to migrate to a fixed release. The Content Scanner Tools update can be applied without an upgrade or restart. Cisco contacted Cloud customers who showed signs of compromise. Shadowserver tracks nearly 300 exposed gateways. The advisory has had no revisions since 14 October. This is not a home product.
- What
- Flaw
- Affects
- Cisco Secure Email Gateway (AsyncOS, physical and virtual)
- Affected
- Cisco Secure Email Gateway (physical and virtual) running AsyncOS with File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525
- Fixed in
- AsyncOS 15.5.5-014
AsyncOS 16.5.0-780
Content Scanner Tools 25.3.0.5525 or later
AsyncOS 16.0: migrate to a fixed release - Since
- 14 Oct 2026
- Closed
- 14 Oct 2026
Timeline
- Update
BleepingComputer reported Cisco had published indicators of compromise, deployed mitigations on its own cloud infrastructure and contacted Secure Email Cloud customers who showed signs of compromise. Shadowserver tracks nearly 300 internet-exposed gateways. Cisco gave no details of the attacks.
- CISA added
CISA added CVE-2026-76519 to its list of flaws being used in attacks, according to the report supplied to HARD. A search summary says federal agencies were told to patch by 17 October; HARD did not read CISA's own entry.
- Made publicFixed
Cisco published advisory cisco-sa-esa-afw-zqYJkjxp for CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway. It said its PSIRT knew of active exploitation in October 2026 and listed fixes for AsyncOS 15.5 and 16.5, plus a Content Scanner Tools update.
Sources
- Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)Cisco · 14 Oct 2026
- Cisco patches actively exploited Secure Email Gateway zero-dayBleepingComputer · 14 Oct 2026