Cisco Secure Email Gateway Patch Addresses Actively Exploited Vulnerability
Cisco released a patch for the critical CVE-2026-76519 vulnerability in Secure Email Gateway. After a crafted attachment is delivered, the flaw could allow remote command execution with root privileges.
The Cisco Secure Email Gateway patch addresses the critical CVE-2026-76519 vulnerability, which attackers are actively exploiting, according to the manufacturer. The flaw received a CVSS score of 9.8 out of 10 and affects physical and virtual deployments of the email security gateway when specific configuration conditions are met.
Cisco published a security advisory on October 14, 2026. On the same day, the U.S. agency CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog, which lists flaws with known exploitation.
The Cisco Secure Email Gateway patch is available in newer scanning tools
The vulnerability is located in the AMP File Reputation mechanism. An unauthenticated remote attacker can send an email with a crafted attachment and exploit the flaw to write arbitrary files to the device. Successful exploitation could lead to command execution with root privileges.
According to Cisco, the device is vulnerable when all of the following conditions are met:
- it is a physical or virtual Cisco Secure Email Gateway,
- the File Reputation service is enabled and assigned to an email policy,
- the Content Scanner Tools version in use is older than 25.3.0.5525.
The patch is available in Content Scanner Tools version 25.3.0.5525 and later. Cisco also included it in AsyncOS releases 15.5.5-014 and 16.5.0-780. No workaround is available.
The risk affects an email gateway processing incoming messages
Secure Email Gateway processes incoming email communications, so a vulnerable system may be accessible to an attacker through a delivered message. In a successful attack, the attacker could gain root access. Cisco also warns that such an attacker could delete or conceal traces of their activity.
Operators of on-premises and virtual installations should verify that the File Reputation service is enabled and used in a policy, and check the Content Scanner Tools version. If the device meets the vulnerability conditions, they should apply the available patch. Cisco also recommends reviewing external network and firewall logs.
If indicators of compromise appear, Cisco’s procedure calls for restoring virtual appliances and changing credentials and cryptographic material.
The cloud service received the patch through standard updates
According to the manufacturer, Cisco Secure Email Cloud Gateway has already received the patch through standard updates. Its customers should not perform a separate update.
Cisco has not disclosed attacker attribution, the number of affected organizations, or campaign details. It has also not been publicly confirmed how many deployments meet all vulnerability conditions or have already been compromised.
Further information may come from any technical details and indicators of compromise Cisco provides, as well as reports from security teams about the scale of the attacks and subsequent intrusions.
Sources
- Cisco Security Advisory – Confirms CVE-2026-76519, active exploitation, vulnerability conditions, fixed versions, the absence of a workaround, and procedures for suspected compromise.
- CISA Known Exploited Vulnerabilities Catalog – Confirms that CVE-2026-76519 was added to the catalog of known actively exploited vulnerabilities.
- BleepingComputer – Independently summarizes the patch release, active exploitation, and Cisco’s warnings about forensic log review.
Verified and updated: October 15, 2026 06:23
