Cisco has issued a warning about active exploitation of a critical vulnerability in its Secure Email Gateway, which allows attackers to write files to the operating system without authentication. This flaw poses significant security risks as it can be leveraged to execute commands with root privileges. The vulnerability, identified during Cisco’s internal security assessments, has been assigned CVE-2026-76519 with a CVSS score of 9.8.
Details of the Exploitation
The exploit involves sending a specially crafted email attachment through the gateway, which if successful, allows the attacker to execute commands as the root user. The vulnerability affects systems where the File Reputation service is active and running an outdated Content Scanner Tools package, specifically versions prior to 25.3.0.5525. Cisco emphasizes the importance of upgrading to AsyncOS 15.5.5-014 or 16.5.0-780, as these versions contain necessary security patches.
To mitigate this risk, Cisco has automatically deployed the necessary updates for its Secure Email Cloud service customers. However, administrators of on-premise versions must ensure that their systems are updated to the latest scanner tools version.
Identifying Vulnerable Systems
To determine if a system is vulnerable, administrators should check if the File Reputation service is enabled within their mail policies. Additionally, it is crucial to verify the version of the Content Scanner Tools via the command-line interface using the command contentscannerstatus. If automatic updates are disabled, manual intervention is required to apply the latest updates.
Physical and virtual gateways running outdated AsyncOS versions are susceptible to this flaw, while Cisco’s Secure Email and Web Manager, as well as the Secure Web Appliance, remain unaffected.
Steps for Remediation and Future Prevention
In the event of a suspected compromise, Cisco advises running the command grep “System Security” system_logs to check for indicators of exploitation. A compromised system requires careful handling to preserve forensic data. For virtual appliances, rebuilding the system with new credentials and monitoring for anomalous activities is recommended.
Cisco’s disclosure policy mandates that vulnerabilities known to be exploited receive individual CVEs. This particular flaw was part of a broader security update released in September, addressing multiple high-severity issues.
As cyber threats continue to evolve, organizations are urged to maintain up-to-date security practices and regularly monitor their systems for vulnerabilities. Cisco’s proactive measures and advisories play a crucial role in helping businesses safeguard their digital infrastructure.
