Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco has disclosed that attackers are actively exploiting a critical flaw, CVE-2026-76519 (CVSS 9.8), affecting the Advanced Malware Protection component of its Secure Email Gateway appliance. The bug lets unauthenticated remote attackers send malicious email attachments that write arbitrary files to the underlying operating system, ultimately enabling root-level command execution, when file reputation scanning is enabled with Content Scanner Tools versions older than 25.3.0.5525.

Cisco says its PSIRT first observed exploitation in October 2026 and has already contacted customers whose Cisco Secure Email Cloud devices showed signs of compromise, while rolling out mitigations it can control directly. The company had actually shipped fixes back on September 14 in AsyncOS versions 15.5.5-014 and 16.5.0-780, originally bundled under the broader advisory for CVE-2026-76440, before updating that advisory this week to flag in-the-wild attacks.

Administrators are urged to inspect external logs for unusual uploads or downloads, contact Cisco TAC if compromise is suspected on physical hardware, and for virtual appliances to rebuild from scratch on patched software while rotating credentials. This marks the second Secure Email Gateway zero-day exploited since mid-September, following the similarly root-granting CVE-2026-76461, and CISA has added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 17.