Cisco patches a Secure Email Gateway bug already under attack
CVE-2026-76519 lets an unauthenticated attacker write files and run commands as root on Secure Email Gateway, no login or user action needed. CISA gave federal agencies three days to patch.
Cisco disclosed CVE-2026-76519 on 14 October, a critical flaw in Secure Email Gateway’s Advanced Malware Protection feature. Improper handling of email attachments lets an unauthenticated remote attacker write arbitrary files and execute commands as root, no login and no user interaction required. Cisco PSIRT says it became aware of active exploitation this month.
The bug only applies when the File Reputation service is enabled in a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525. It carries a CVSS score of 9.8, and Cisco says there are no workarounds: the only fix is upgrading AsyncOS to 15.5.5-014 or 16.5.0-780, and Content Scanner Tools to 25.3.0.5525 or later. CISA added it to its Known Exploited Vulnerabilities catalog the same day, giving federal civilian agencies until 17 October to patch.
Why it matters: if you run Secure Email Gateway with File Reputation turned on, this is remote root from a single crafted attachment, before anyone opens it. There’s no mitigating configuration to fall back on while you schedule the upgrade.
The caveat: Cisco hasn’t published how attackers are reaching the flaw in the wild, only that exploitation is confirmed.