Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Cisco has confirmed that attackers are actively exploiting a critical, unauthenticated vulnerability in its Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. The bug lets a remote sender, without needing any credentials, deliver a specially crafted attachment that writes files to the device's operating system, potentially enabling root-level command execution. It only affects gateways that have the File Reputation (AMP) service turned on and are running a Content Scanner Tools package older than version 25.3.0.5525; Cisco discovered the issue through its own internal scanning and learned of real-world attacks in October. Fixes were actually already included in the September 14 hardening builds AsyncOS 15.5.5-014 and 16.5.0-780, plus the standalone scanner update, and this marks the second Secure Email Gateway bug — after the SQL-injection flaw CVE-2026-76461 disclosed the same month — that Cisco says is being actively exploited.