Cisco has warned that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway appliance, giving unauthenticated remote attackers a path to write arbitrary files to the underlying operating system and execute commands with root privileges, according to SecurityWeek’s report.
Tracked as CVE-2026-76519, the flaw has a CVSS score of 9.8 out of 10 and affects the appliance’s Advanced Malware Protection feature. Exploitation requires the file reputation service to be enabled and Content Scanner Tools version earlier than 25.3.0.5525 to be installed. Attackers can send crafted email attachments designed to trigger the vulnerability.
Cisco’s Product Security Incident Response Team became aware of active exploitation in October 2026. The company also published indicators of compromise, while warning that attackers with elevated access may remove or conceal evidence. Administrators should review network and firewall logs outside affected appliances for suspicious uploads or downloads involving external IP addresses.
Cisco says fixes for the vulnerability were released on September 14 in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780. Customers should migrate to a patched AsyncOS release as soon as possible. The company previously grouped the issue and other vulnerabilities under CVE-2026-76440 before updating its September advisory to identify CVE-2026-76519 and its in-the-wild exploitation.
For suspected compromise of a physical appliance, Cisco advises contacting its Technical Assistance Center. For virtual appliances, the company recommends deploying a new virtual machine running fixed software, rebuilding the configuration from scratch, rotating credentials and preserving forensic evidence.
Cisco said it directly contacted customers using Cisco Secure Email Cloud where possible compromise indicators were identified, and that it had deployed mitigations within its managed environment. The U.S. cybersecurity agency CISA has added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog and set an October 17 patch deadline for federal agencies.
The issue is the second Cisco Secure Email Gateway vulnerability reported as exploited in the wild since mid-September. The earlier flaw, CVE-2026-76461, was also described as an unauthenticated vulnerability capable of leading to command execution with root privileges.