[CVE-2026-76519] Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Severity

Critical

Detail

Cisco has warned of active exploitation targeting CVE-2026-76519, a critical vulnerability affecting Cisco Secure Email Gateway (SEG). The vulnerability allows an unauthenticated attacker to write arbitrary files to the underlying operating system by sending a specially crafted email attachment through a vulnerable gateway. Successful exploitation could enable attackers to execute commands with root privileges on the affected appliance.

The vulnerability affects gateways where the File Reputation service is enabled and the Content Scanner Tools package version is earlier than 25.3.0.5525. According to Cisco, exploitation activity was observed in October 2026; however, the company did not disclose details regarding the threat actors, the scale of attacks, or whether root-level compromise was successfully achieved in observed incidents.

The vulnerability was identified through internal security scanning by Cisco. The company has notified customers of its managed Secure Email Cloud service whose devices showed potential indicators of compromise and has initiated remediation and recovery efforts where required.

CVE ID	Summary	CVSS Score
CVE-2026-76519	An arbitrary file-write vulnerability in Cisco Secure Email Gateway that could allow an unauthenticated attacker to write files to the operating system and execute commands with root privileges.	9.8 (Critical)

Affected Products

The vulnerability affects physical and virtual Cisco SEG appliances when:

The File Reputation service is enabled.
The Content Scanner Tools version is earlier than 25.3.0.5525.

The following products are not affected:

Cisco Secure Email and Web Manager
Cisco Secure Web Appliance

Recommendation

Organizations should implement the following measures immediately:

Update Content Scanner Tools to version 25.3.0.5525 or later.
Upgrade affected gateways to AsyncOS 15.5.5-014, 16.5.0-780, or later supported releases.
Verify installed scanner versions using the contentscannerstatus command.
Review systems for indicators of compromise by checking security scan results and appliance logs.
Monitor for suspicious email attachments, unauthorized file creation, unexpected outbound connections, and unusual system activity.
If compromise is suspected on a virtual appliance, preserve forensic evidence before upgrading and rebuild the appliance using a fresh installation on a fixed version.
Renew credentials, SSH keys, and other cryptographic material following confirmed compromise.

Source