Cisco has disclosed an actively exploited vulnerability in Cisco Secure Email Gateway that allows unauthenticated remote attackers to write arbitrary files and execute commands with root privileges.
Tracked as CVE-2026-76519, the flaw has a CVSS score of 9.8 and affects the Advanced Malware Protection feature when specific file-reputation and component-version conditions are met.
Cisco identified the vulnerability through internal security scanning and released fixes. No workarounds address the vulnerability.
Critical Cisco Email Gateway Zero-Day
The vulnerability stems from improper handling of email attachments when the File Reputation service is enabled. An attacker can exploit the flaw by sending an email containing a crafted attachment through an affected gateway.
Successful exploitation enables arbitrary file writes on the underlying operating system and command execution with root privileges.
The advisory classifies the weakness as CWE-23, a relative path traversal issue. Its CVSS vector indicates network accessibility, low attack complexity, no required privileges, and no user interaction.
Both physical and virtual Cisco Secure Email Gateway appliances are affected when they run vulnerable AsyncOS software, have File Reputation enabled and assigned to a mail policy, and use Content Scanner Tools earlier than version 25.3.0.5525.
Administrators can inspect File Reputation settings under the incoming or outgoing mail policies’ Advanced Malware Protection configuration. The CLI command contentscannerstatus identifies the installed Content Scanner Tools version.
Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases for the corresponding software branches. Customers running AsyncOS 16.0 must migrate to a fixed release. Cisco strongly recommends that customers using releases earlier than 16.5 migrate to 16.5.0-780.
The fix is also available through Content Scanner Tools version 25.3.0.5525 or later for licensed, supported AsyncOS releases. Updating this component requires no software upgrade or product restart.
Administrators who disabled automatic updates can initiate a manual update using contentscannerupdate, then verify the installed version. Cisco says its Secure Email Cloud Gateway infrastructure already has the fixed component deployed.
Administrators should review appliance logs using grep "System Security" system_logs and repeat the check on every cluster member. Messages can indicate suspected compromise, an incomplete security scan, or no detected compromise indicators.
However, Cisco warns that root access allows attackers to hide or delete evidence. Organizations should therefore cross-check external firewall and network logs for suspicious transfers involving affected gateways.
For suspected compromise of physical appliances, Cisco recommends contacting its Technical Assistance Center. For virtual appliances, organizations should preserve forensic evidence before rebuilding because upgrades destroy forensic data and logs.
Recovery guidance includes deploying a fresh virtual machine, rebuilding configuration without importing previous configuration files, and renewing credentials and cryptographic materials.
Because compromised cluster SSH keys could expose additional members, Cisco recommends restoring every member of an affected cluster. Cloud customers who contacted us should also renew credentials and cryptographic materials wherever possible.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
