CVE-2026-76519, scored 9.8, is an active exploit that lets an unauthenticated sender write files to the operating system of a Cisco Secure Email Gateway and — if the attack succeeds — run commands as root, Cisco said in an advisory published Wednesday.
Cisco Secure Email Gateway: how the vulnerability is exploited and who is exposed
Cisco says attackers send a crafted email attachment through a Secure Email Gateway. A gateway is vulnerable only when two conditions both hold: the File Reputation service (part of Advanced Malware Protection for attachments) is enabled and assigned to a mail policy, and the appliance's Content Scanner Tools package is older than version 25.3.0.5525. Physical and virtual gateways on affected AsyncOS releases are at risk; Secure Email and Web Manager and Secure Web Appliance are not.
The advisory specifies the exploitation path as a sender with no login writing files to the appliance OS via the crafted attachment, and then executing commands as root. Cisco discovered the flaw through internal security scanning and says it became aware of active attacks in October. The advisory does not disclose how many devices were attacked, who is behind the activity, or whether any attackers achieved root on targeted devices.
Content Scanner Tools 25.3.0.5525 and AsyncOS builds: the fixes available
The fastest remediation is the Content Scanner Tools update. Cisco shipped the fix in the scanner update, version 25.3.0.5525 or later, which installs without a software upgrade or restart. The full AsyncOS builds listed as fixed in the September 14 hardening release are 15.5.5-014 and 16.5.0-780; Cisco recommends gateways earlier than 16.5 move to 16.5.0-780. There is no fixed 16.0 build listed, and Cisco notes a 16.0 gateway must confirm the scanner version shown by contentscannerstatus when remaining on 16.0.
Gateways with automatic Content Scanner Tools updates turned on need no action once the update has applied, but administrators should confirm the update by running contentscannerstatus at the CLI to ensure the version is 25.3.0.5525 or later. Where automatic updates are off, run contentscannerupdate at the CLI or enable automatic updates under Security Services > Service Updates.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblegrep "System Security" system_logs: Cisco's compromise check and response steps
Cisco provides one CLI check for attempted exploitation: grep "System Security" system_logs. That command returns one of three messages, verbatim:
- System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.
- Compromise detected. Follow the recovery steps below.System Security: Security scan did not complete. Contact TAC for further recommendations. Contact Cisco's Technical Assistance Center (TAC).
- System Security: No compromise indicator was found.
The advisory warns that a clean result is not proof of absence; an attacker with root could remove or hide evidence. Administrators should also check firewall and network logs outside the device for unexpected uploads to external IP addresses or downloads from malicious ones. Cisco does not describe what the scan looks for.
If a physical appliance is suspected to be compromised, Cisco asks customers to contact TAC and to enable remote access for investigation. For a virtual appliance, Cisco's ordered steps are explicit: preserve forensic data first (upgrading a compromised instance destroys logs and evidence); deploy a new virtual machine on a fixed release; rebuild the configuration without importing any previous configuration file; renew credentials and cryptographic material; and continue monitoring for unusual behavior.
Cisco warns that cluster authentication uses SSH key pairs: "A compromised member's private keys could give the attacker a way into the others," so it recommends restoring every member of a cluster that contains at least one compromised appliance. Cisco has contacted Secure Email Cloud customers whose devices showed "indicators of possible compromise" and says it has already deployed the fixed scanner there; those managed customers may not need or be able to run the CLI check themselves.
September hardening release and the recent pattern of root-level exploits
This file-write flaw was fixed in the September 14 hardening release and given its own CVE in the updated advisory. It sits in the path traversal class and, according to Cisco's update, is now one of "Two of them are known to be actively exploited" — the other being September's CVE-2026-76461, a SQL injection flaw in email parsing that could also allow unauthenticated root command execution. Cisco notes the two flaws are in different parts of the software and have different log checks, and it has not linked the attacks.
Cisco also frames this incident in a broader recent pattern: the file-write flaw is the third root-level Secure Email Gateway flaw Cisco has confirmed exploited since December. In January Cisco patched CVE-2025-20393, a zero-day in the spam quarantine feature that Cisco Talos said was used by a China-linked group tracked as UAT-9686.
What this means for Secure Email Cloud customers, administrators, and procurement teams
Secure Email Cloud customers already contacted by Cisco should follow the vendor's instruction to renew credentials and cryptographic material where possible and rely on the deployed fixed scanner. Gateway administrators must confirm scanner version with contentscannerstatus and either run contentscannerupdate or enable automatic updates under Security Services > Service Updates. Procurement and operations teams should note Cisco's recommendation to migrate gateways earlier than 16.5 to 16.5.0-780 and that no workaround exists; for virtual appliances that show signs of compromise, rebuilding on a fixed release and changing credentials is required.
Cisco's advisory supplies clear commands and recovery steps; it leaves open, however, how widespread successful exploitation has been and whether attackers achieved persistent root access on any appliances. For now, the immediate, concrete actions are to confirm scanner version, apply the 25.3.0.5525 update or the fixed AsyncOS builds, and treat any signs of compromise as needing full restoration and credential renewal.
https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html
