Cisco has confirmed that attackers are exploiting CVE-2026-76519, a critical flaw in its Secure Email Gateway appliances that lets an unauthenticated sender reach root by emailing a crafted attachment. It is the second Secure Email Gateway bug exploited in the wild since mid-September.
Cisco Confirms Active Exploitation of the Advanced Malware Protection Flaw
Cisco updated its advisory on Wednesday to say its Product Security Incident Response Team became aware of active exploitation of CVE-2026-76519 in October. The flaw carries a CVSS score of 9.8 and is described as a relative path traversal and arbitrary file write weakness in the Advanced Malware Protection (AMP) feature of the gateway’s AsyncOS software, which runs on both physical and virtual appliances.
Cisco said it found the flaw during internal scanning. The company has not disclosed how many devices were compromised, who is behind the attacks, or whether the attackers actually obtained root access on any appliance.
How a Crafted Email Attachment Leads to Root Commands on AsyncOS
An unauthenticated remote attacker sends an email with a specially crafted attachment through the gateway. The path traversal weakness allows the attacker to write arbitrary files to the underlying operating system, and from there to run commands as root. No credentials and no user interaction on the appliance are required, which places the attack surface wherever a vulnerable gateway processes inbound mail.
Which Gateways Are Exposed: File Reputation and Content Scanner Tools Below 25.3.0.5525
Not every gateway is vulnerable. Cisco says an appliance is affected only if the File Reputation feature is enabled and assigned to a mail policy, and the Content Scanner Tools component is older than version 25.3.0.5525. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected. The company says there is no workaround for the flaw.
The Shadowserver Foundation tracks nearly 300 Cisco Secure Email Gateway instances exposed to the internet, though that count does not exclude honeypots, so the number of real production devices reachable online may be lower.
Fixed Builds, a Content Scanner Update and a 16.0 Caveat
Cisco released fixed AsyncOS builds on September 14: 15.5.5-014 and 16.5.0-780. Those builds were originally grouped under a different identifier, CVE-2026-76440, and Cisco now says they also address CVE-2026-76519. A separate route exists through the Content Scanner Tools component: updating it to 25.3.0.5525 or later fixes the flaw without a reboot, using the contentscannerupdate command-line command.
One configuration remains exposed even after an AsyncOS update. A gateway running the 16.0 branch at build 16.0.4-302 is not fixed by the AsyncOS build alone, according to Cisco.
CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog on Wednesday, giving federal civilian agencies until October 17 to remediate.
Cisco’s Indicators of Compromise and Rebuild Guidance for Virtual Appliances
Alongside the advisory update, Cisco published indicators of compromise and advised customers to check network and firewall logs outside the appliance, since attackers with root access may remove evidence of exploitation from the device itself. The company said it contacted Secure Email Cloud customers who showed signs of compromise and deployed mitigations on its managed cloud instances.
For virtual appliances, Cisco recommends deploying a new virtual machine on a fixed release, rebuilding the configuration from scratch, rotating credentials and preserving forensic evidence. That guidance goes beyond a routine patch instruction. It suggests Cisco regards a gateway that processed a malicious attachment as an untrustworthy system, not one that can simply be updated back to health.
Why Root on One Gateway Can Expose an Entire Cluster
One security analysis of the flaw points to the downstream risk: root access lets an attacker erase logs and steal SSH keys that are shared across clustered appliances, so a single compromised node can open a path to every other node in the cluster. Mail gateways also sit between the internet and internal mail systems, which makes them a useful foothold for an intruder.
CVE-2026-76461 and the Earlier AsyncOS Zero-Day Exploitation Pattern
CVE-2026-76519 follows CVE-2026-76461, an unauthenticated command-execution flaw that also gave root access and that attackers exploited from mid-September. An earlier AsyncOS flaw, CVE-2025-20393, was exploited in zero-day attacks beginning in November 2025. Three exploited AsyncOS vulnerabilities in under a year suggest that attackers are returning to the same product line for new weaknesses, a pattern that defenders running the gateway as an internet-facing mail path have to weigh when deciding how quickly to patch the next advisory.
