Cisco Secure Email Gateway Root-Execution Flaw Exploited Through Crafted Attachments

Cisco and Finland’s Traficom warned of active exploitation of CVE-2026-76519, a critical Cisco Secure Email Gateway vulnerability rated CVSS 9.8. An unauthenticated attacker can send a specially crafted email attachment through an affected appliance to write files to its operating system and potentially execute commands with root privileges. Physical and virtual appliances are exposed when Cisco AMP File Reputation is enabled and assigned to an email policy and Content Scanner Tools is older than 25.3.0.5525. Cisco became aware of exploitation in October and notified managed Secure Email Cloud customers whose appliances showed possible compromise indicators. It has not disclosed attack counts, attribution, or confirmed root-level access; this is the second Secure Email Gateway flaw confirmed under attack within a month, with no established link between the campaigns.

Administrators should immediately update Content Scanner Tools to 25.3.0.5525 or later, an update Cisco says requires neither an AsyncOS upgrade nor a restart. Cisco also delivered fixes in AsyncOS 15.5.5-014 and 16.5.0-780; Traficom advises customers running versions earlier than 16.5 to upgrade to 16.5.0-780. Defenders should inspect system_logs, assess every cluster member individually, and preserve forensic evidence before recovery. Cisco recommends rebuilding compromised virtual appliances and renewing credentials and cryptographic material. The warning follows Cisco’s broader move toward predictable security releases on the first and third Wednesdays of each month, with seven days’ advance notice, in response to AI-accelerated vulnerability discovery. That model retains emergency handling for active exploitation and zero-days.