Cisco urged customers to patch a critical Secure Email Gateway vulnerability that attackers have exploited to execute commands with root privileges by sending malicious emails.
The flaw, tracked as CVE-2026-76519, has a CVSS severity score of 9.8 out of 10. A Cisco spokesperson told The Register it affects “a limited number of customers.”
Cisco and the U.S. government issued separate advisories on Wednesday warning that attackers had exploited the vulnerability before a fix was released. The U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until Saturday to remediate it.
“We are aware of active exploitation of this vulnerability,” the Cisco spokesperson told The Register. The spokesperson declined to say how many appliances had been compromised or what attackers were doing after gaining access.
“We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory,” the spokesperson said.
The vulnerability is in the gateway’s Advanced Malware Protection feature and results from improper handling of email attachments. A remote attacker without authentication can send an email with a malicious attachment to write files and execute commands with root privileges on the appliance’s operating system.
Both physical and virtual Secure Email Gateway appliances running vulnerable Cisco AsyncOS Software are affected if two conditions are met: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. File Reputation is part of Advanced Malware Protection.
Cisco’s Wednesday advisory provides instructions for checking whether File Reputation is enabled and identifying the installed Content Scanner Tools version.
Upgrading to a fixed AsyncOS Software release patches the vulnerability. No workarounds are available. Cisco recommends that customers running releases earlier than version 16.5 migrate to version 16.5.0-780.
Cisco said in its alert that it became aware of active exploitation in October. The flaw is the second Secure Email Gateway zero-day in as many months.
In mid-September, Cisco warned that criminals were exploiting a similar gateway vulnerability, CVE-2026-76461, which also allowed a malicious email to provide root access.
In January, attackers exploited another critical AsyncOS vulnerability, CVE-2025-20393, to compromise Cisco Secure Email Gateway appliances and install persistence mechanisms. That vulnerability later received a CVSS score of 10.
Featured image credit
