Science & Tech · Cybersecurity · 3 hrs ago
Cisco fixes email gateway flaw exploited in attacks
Attackers have exploited a flaw in Cisco Secure Email Gateway before a fix was available.
The vulnerability affects physical and virtual appliances running Cisco AsyncOS, Cisco’s software for the devices.
A malicious email attachment can let an attacker write files and run commands with root-level control of the appliance without logging in.
The flaw affects devices only when the File Reputation service is enabled for a mail policy and Content Scanner Tools is earlier than version 25.3.0.5525.
Cisco says it is aware of active attacks, but has not shared how many devices were compromised or what attackers did.
Cisco has released a software fix and says there are no workarounds; it recommends upgrading affected systems and checking for signs of compromise.
The US government has added the flaw to its list of actively exploited vulnerabilities and set a Saturday deadline for federal agencies to fix it.
Cisco has patched a Secure Email Gateway flaw that attackers exploited in zero-day attacks.
The vulnerability, tracked as CVE-2026-76519, can let remote, unauthenticated attackers run commands with root privileges.
It affects appliances with specific Advanced Malware Protection settings and Content Scanner Tools versions earlier than 25.3.0.5525.
Cisco says customers should upgrade to a fixed software release; there are no workarounds.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for federal agencies to fix it.
- Who
- Attackers exploited the flaw. Cisco issued a fix, and CISA added it to its catalog.
- What
- A vulnerability in Cisco Secure Email Gateway can let attackers write files and execute commands with root privileges.
- When
- Cisco said it became aware of active exploitation in October 2026. The advisories were issued on Wednesday.
- Where
- Cisco Secure Email Gateway appliances running vulnerable Cisco AsyncOS Software.
- Why
- Improper handling of email attachments in the Advanced Malware Protection feature enables exploitation through a malicious email.
This story does not have two clearly opposing sides.
Cisco says its Product Security Incident Response Team became aware of active exploitation.
Cisco issued an advisory about the flaw and a fix; CISA also warned about exploitation and added the vulnerability to its catalog.
CISA set a deadline for federal agencies to fix the issue.
- Vulnerability
- CVE-2026-76519
- CVSS rating
- 9.8 out of 10
- Affected feature
- Advanced Malware Protection in Cisco Secure Email Gateway
- Affected scanner version
- Content Scanner Tools earlier than 25.3.0.5525
- Recommended release
- Cisco AsyncOS Software 16.5.0-780 for customers running releases earlier than 16.5
3 sources
What people are saying
We are aware of active exploitation of this vulnerability
We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.