Cisco says attackers are exploiting a critical flaw in its Secure Email Gateway, the appliance many organizations use to screen incoming mail for spam and malware. An outside sender who is not logged in can use a specially crafted email attachment to write files onto the device and, if the attack works, run commands with full root control.
Cisco found the bug, CVE-2026-76519, during its own internal security scanning and learned in October that it was being used in attacks. It carries a severity score of 9.8 out of 10.
Who is exposed
Both hardware and virtual gateways can be hit, but only when two settings line up: the File Reputation feature, part of Cisco's Advanced Malware Protection for attachments, is switched on in a mail policy, and the gateway's Content Scanner Tools package is below version 25.3.0.5525. Cisco said its Secure Email and Web Manager and its Secure Web Appliance are not affected.
Fixes
The fix has been included since Sept. 14 in AsyncOS builds 15.5.5-014 and 16.5.0-780, part of a hardening release Cisco now says covered this flaw. Administrators can also get the fix by moving Content Scanner Tools to 25.3.0.5525 or newer, an update that does not need a full upgrade or a reboot. Cisco recommends that any gateway older than 16.5 move to 16.5.0-780.
There is no workaround. Cisco warned that upgrading a virtual appliance that has already been compromised wipes the logs and forensic evidence, and said compromised systems should be rebuilt with new credentials. It published a single command administrators can run on the appliance to search its logs for signs of attempted exploitation.