Cisco has issued a warning to its customers regarding a severe vulnerability discovered in its Secure Email Gateway. This security flaw, identified as CVE-2026-76519, has been actively exploited by cyber attackers, posing significant risks to affected systems.
Vulnerability Details
Rated with a CVSS score of 9.8 out of 10, this critical vulnerability affects the Advanced Malware Protection (AMP) feature of the Secure Email Gateway. The flaw allows remote, unauthenticated attackers to manipulate the system by writing arbitrary files on the operating system. Cisco became aware of active exploitation of this vulnerability in October 2026.
The vulnerability is specifically linked to the email attachment handling process when the file reputation service is enabled and if the Content Scanner Tools version is earlier than 25.3.0.5525. Malicious actors can exploit this flaw by sending specially crafted email attachments, allowing them to execute commands with root privileges.
Mitigation and Response
In response to this threat, Cisco has provided indicators of compromise (IoCs) to assist organizations in identifying and responding to potential intrusions. However, the company warns that attackers might use their elevated access to obscure evidence of exploitation, necessitating a thorough review of network and firewall logs for any unusual activity.
Cisco advises customers to contact their Technical Assistance Center (TAC) if they suspect exploitation on physical devices. For virtual appliances, the company recommends setting up a new virtual machine with an updated software release, rebuilding configurations, and updating credentials, while ensuring forensic evidence is preserved.
Patch and Future Outlook
Customers are strongly urged to upgrade to a patched version of AsyncOS software immediately. Fixes for CVE-2026-76519 were released on September 14, and are available in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780. Cisco has also updated its September advisory to reflect the real-world exploitation of this vulnerability.
This is the second instance of exploitation involving Cisco’s Secure Email Gateway since mid-September, following a similar issue with CVE-2026-76461. The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches by October 17.
Staying informed and acting promptly on security advisories is crucial for organizations to protect their infrastructure from such vulnerabilities. Cisco remains engaged in remediation and recovery efforts to assist affected customers effectively.
