Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

Cisco has warned that attackers are actively exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway that can give them root access to affected appliances. Tracked as CVE-2026-76519, the flaw carries a CVSS score of 9.8 and allows attacks through specially crafted email attachments without requiring a login.

Cisco published its advisory on October 14, 2026. The company said its security response team became aware of active exploitation in October. Public reporting has not identified the attackers or established how many devices have been compromised, leaving the scale of the campaign unclear.

The vulnerability sits in the Advanced Malware Protection feature, known as AMP. Cisco says the gateway fails to handle certain email attachments safely when its File Reputation service is enabled. An attacker can send a malicious attachment through an affected device to write arbitrary files and potentially execute commands with root privileges.

Root access gives an attacker control over the underlying operating system. The entry point is the gateway processing an attachment, rather than a user opening a file. Cisco has not described a requirement for a recipient to click a link or launch the attachment.

Cisco Secure Email Gateway 0-Day Vulnerability

Both physical and virtual appliances are affected when they run vulnerable AsyncOS software and meet two conditions. File Reputation must be enabled and assigned to a mail policy, and the Content Scanner Tools package must be older than version 25.3.0.5525. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.

This disclosure follows another actively exploited Secure Email Gateway flaw, CVE-2026-76461, reported in September. Earlier coverage of CVE-2025-20393 also documented attacks against Cisco email appliances, although that vulnerability involved the Spam Quarantine feature rather than AMP.

Administrators can check File Reputation under the Advanced Malware Protection settings for incoming or outgoing mail policies. The contentscannerstatus command shows the installed Content Scanner Tools version.

For investigation, Cisco recommends running grep "System Security" system_logs and checking every device in a cluster. A suspected compromise message requires incident response, while an incomplete security scan requires support from Cisco’s Technical Assistance Center.

A clean result does not rule out an attack. Cisco warns that intruders with root access may hide or delete evidence. Security teams should also review independent firewall and network logs for unexpected uploads from the gateway or downloads from suspicious addresses.

Patching closes the entry point but does not establish whether attackers previously gained access. Organizations that find suspicious activity should contact Cisco TAC and preserve available evidence to support a detailed investigation.

Fixed Versions and Immediate Action

Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases. Customers on version 16.0 should migrate to a fixed release. Cisco strongly recommends moving installations earlier than version 16.5 to 16.5.0-780.

The fix is also available through Content Scanner Tools version 25.3.0.5525 or later for licensed, supported AsyncOS releases. This package update does not require a full software upgrade or restart. Administrators who disabled automatic updates can request it using contentscannerupdate, then verify the installed version.

There are no workarounds. Customers with automatic updates enabled should confirm that the fixed package has actually arrived rather than assume protection.

Cisco says it has already deployed the corrected package across Secure Email Cloud Gateway, so those customers do not need to apply the update themselves. For affected organizations, updating the gateway and checking for earlier compromise should proceed together.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.