Cisco said attackers are actively exploiting a zero-day vulnerability in Cisco Secure Email Gateway that can let unauthenticated remote attackers write arbitrary files and execute commands with root privileges. The vulnerability, tracked as CVE-2026-76519, affects appliances with specific Advanced Malware Protection and Content Scanner Tools configurations, and Cisco released its initial advisory on October 14, 2026.
Key Points
- CVE-2026-76519 is under active exploitation, according to Cisco.
- The flaw affects physical and virtual Secure Email Gateway appliances with File Reputation enabled and an outdated Content Scanner Tools package.
- Attackers can exploit the issue by sending a crafted email attachment, potentially gaining root-level control.
- Cisco has released software updates, but no workaround addresses the vulnerability.
- Administrators should apply the fix, check logs, and investigate external network activity for signs of compromise.
Cisco said its Product Security Incident Response Team became aware of active exploitation in October 2026. The company said it found the vulnerability during internal security scanning.
How the flaw works
The vulnerability is in the Advanced Malware Protection feature of Cisco Secure Email Gateway. Cisco attributed the issue to improper handling of email attachments when the File Reputation service is enabled.
An unauthenticated remote attacker can exploit the flaw by sending a crafted attachment through an affected appliance. Cisco described the potential impact:
“A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.”
Cisco Security Advisory
The affected product includes physical and virtual Cisco Secure Email Gateway appliances running a vulnerable Cisco AsyncOS release and meeting both required conditions. File Reputation, which is part of Cisco AMP, must be enabled and assigned to a mail policy, and Content Scanner Tools must be earlier than version 25.3.0.5525.
Administrators can check whether File Reputation is enabled in the web interface under Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection. They should inspect the Enable File Reputation checkbox for the relevant mail policy.
The Content Scanner Tools version can be checked with the CLI command contentscannerstatus. Cisco gives 25.2.0.5427.15.5.001 as an example of a vulnerable version.
Cisco said the vulnerability does not affect Secure Email and Web Manager or Secure Web Appliance.
Fixes and updates
Cisco said it has released software updates and that no workaround addresses CVE-2026-76519. The first fixed AsyncOS releases listed in the advisory are 15.5.5-014 for release 15.5 and 16.5.0-780 for release 16.5. For release 16.0, Cisco directs customers to migrate to a fixed release.
Cisco strongly recommends that customers running releases earlier than 16.5 migrate to 16.5.0-780. The company also said the fix is distributed to licensed and supported AsyncOS releases through an updated Content Scanner Tools package, with version 25.3.0.5525 and later containing the fix.
Applying the Content Scanner Tools update does not require an AsyncOS upgrade or product restart. Customers with automatic updates enabled do not need to take action once the update is applied, while customers who disabled automatic updates should install it manually with the CLI command contentscannerupdate.
Secure Email Cloud Gateway customers do not need to take action, according to Cisco. The company said it took protective measures and deployed a fixed Content Scanner Tools version through its standard upgrade process.
Checks for possible compromise
Cisco advised administrators to check the system_logs file for exploitation indicators with the following command:
esa-appliance> grep "System Security" system_logs
For clustered appliances, Cisco said administrators should review the logs of every cluster device. Possible output includes “Suspected compromise indicator was found,” “Compromise detected,” “Security scan did not complete,” and “No compromise indicator was found.” The advisory provides corresponding actions, including contacting Cisco Technical Assistance Center or following its recovery instructions.
Cisco warned that an attacker with root-level command execution may remove or hide evidence of exploitation and indicators of compromise. The company recommends cross-checking network and firewall logs outside the affected appliance for suspicious activity, including unexpected uploads from the appliance to external IP addresses or downloads from malicious IP addresses.
If exploitation is suspected on a physical appliance, Cisco recommends contacting the Cisco Technical Assistance Center. For a virtual appliance, Cisco recommends preserving forensic information before recovery, deploying a new virtual machine with fixed software, rebuilding the configuration without importing previous configuration files, renewing credentials and cryptographic materials, and monitoring for anomalous behavior.
Cisco said private SSH keys used to authenticate between Secure Email Gateway cluster members could be accessed on a compromised appliance. Because those keys may allow an attacker to compromise other cluster members, Cisco recommends restoring every cluster member if at least one appliance in the cluster was compromised.
Cisco’s general hardening guidance includes blocking internet access to the appliance where possible or limiting access to known, trusted hosts. The company also recommends separating mail and management functions onto individual network interfaces, placing appliances behind a firewall, monitoring and retaining logs externally where possible, disabling unnecessary network services such as HTTP and FTP, and restricting administrator access.
Sources
About the Author
