Cisco warns of exploited Secure Email Gateway attachment flaw

What Cisco disclosed

On 14 October 2026, Cisco disclosed CVE-2026-76519, a critical flaw in Secure Email Gateway’s Advanced Malware Protection feature. Cisco says it became aware of active exploitation in October.

The CVE record describes how a crafted email attachment could let an unauthenticated attacker write files and execute commands as root. Physical and virtual gateways are affected when they run vulnerable AsyncOS software, have File Reputation enabled in a mail policy, and use Content Scanner Tools earlier than 25.3.0.5525.

What administrators should do

Check the scanner version with contentscannerstatus. Cisco says Content Scanner Tools 25.3.0.5525 or later fixes the flaw; a scanner update needs no restart. Where automatic updates are disabled, use contentscannerupdate, then verify the installed version. Review Cisco’s fixed AsyncOS releases too.

Check every cluster member for Cisco’s documented compromise indicators and review external network logs. If compromise is suspected, follow its recovery guidance and preserve forensic evidence before upgrading. Installing a fix alone does not establish that an already compromised appliance is clean.

Cisco reports that the fixed scanner is already deployed to Secure Email Cloud Gateway. Cloud customers contacted about possible compromise should follow its recovery instructions.