Swiss SME Cyber Alert: Cisco Secure Email Gateway – exploited flaw enables root commands via email attachment
Cisco has confirmed active exploitation of CVE-2026-76519 in Secure Email Gateway. When a vulnerable on-premises appliance scans a crafted attachment, an unauthenticated attacker can write arbitrary files and execute commands with root privileges.
If your business or IT provider operates a physical or virtual Cisco Secure Email Gateway, ask for the Content Scanner Tools version to be checked today, updated to 25.3.0.5525 or later, and reviewed for signs of compromise.
What happened?
Cisco published a critical advisory for CVE-2026-76519 on 14 October 2026, with a CVSS score of 9.8, and confirmed active exploitation during October. The vulnerability arises when the Advanced Malware Protection feature handles attachments. An attacker only needs to send a crafted email through the gateway; no authentication is required.
Could my company be affected?
Physical and virtual Cisco Secure Email Gateways are affected when the File Reputation service is assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Cisco Secure Email Cloud Gateway is already protected and requires no customer action. Secure Email and Web Manager and Secure Web Appliance are not affected.
What should you do now?
Ask your IT provider to take these steps now:
Update Content Scanner Tools to 25.3.0.5525 or later, or upgrade to AsyncOS 15.5.5-014 or 16.5.0-780. AsyncOS 16.0 must be migrated to a fixed release.
Verify whether automatic Content Scanner Tools updates were enabled and whether the update was actually applied. The presence of an auto-update feature alone is not confirmation.
Check system_logs for Cisco «System Security» messages and inspect external network and firewall logs for unusual uploads or downloads. If compromise is suspected, involve Cisco TAC and preserve forensic data before making changes.
How urgent is it?
Critical – check immediately. The vulnerability is actively exploited, requires no authentication and can provide root control of an email security gateway. Only Cisco Secure Email Cloud Gateway is confirmed by the vendor as already protected centrally.
Information for your IT provider
Exposure requires Cisco AMP File Reputation to be enabled and assigned to a mail policy, with Content Scanner Tools earlier than 25.3.0.5525. Cisco lists 15.5.5-014 and 16.5.0-780 as the first fixed AsyncOS releases; release 16.0 must migrate. There is no workaround. Successful attackers may hide evidence, so Cisco also recommends checking external logs. For a compromised virtual appliance, Cisco recommends rebuilding it, recreating the configuration, and renewing credentials and cryptographic material.
