Cisco Discloses Critical Secure Email Gateway Flaw Exploited in the Wild
Cisco says CVE-2026-76519, rated 9.8, lets attackers run commands as root via a crafted email attachment; CISA added it to its exploited-vulnerabilities list on October 14, 2026.
Cisco has disclosed a critical vulnerability in its Secure Email Gateway product, tracked as CVE-2026-76519 and rated 9.8 under CVSS 3.1, according to dailysecu.com. The company said it confirmed in October 2026 that the flaw is being exploited in the wild.
The vulnerability allows an attacker to write arbitrary files and run commands with root privileges by sending a specially crafted email attachment. No login or action by the recipient is required to trigger the flaw.
Affected systems are physical and virtual appliances running vulnerable AsyncOS with the file reputation service applied to mail policy and a Content Scanner Tools version below 25.3.0.5525. Administrators can check the scanner version with the contentscannerstatus command and should update to 25.3.0.5525 or later; Cisco says the Content Scanner Tools update can be applied without restarting the appliance.
Fixes and mitigation limits
Fixed AsyncOS versions are 15.5.5-014 and 16.5.0-780, and Cisco states that no workaround is available. The company advises administrators to check external firewall and network logs, because attackers could use root privileges to hide their traces.
CISA added the vulnerability to its Known Exploited Vulnerabilities list on October 14, 2026.
Quick answers
What is CVE-2026-76519?
It is a critical vulnerability in Cisco Secure Email Gateway, rated 9.8 under CVSS 3.1, that can let an attacker write arbitrary files and run commands with root privileges by sending a specially crafted email attachment.
Which systems are affected by CVE-2026-76519?
Physical and virtual appliances running vulnerable AsyncOS with the file reputation service applied to mail policy and a Content Scanner Tools version below 25.3.0.5525.
How do I fix CVE-2026-76519?
Cisco says no workaround is available. Administrators should update Content Scanner Tools to 25.3.0.5525 or later, which does not require an appliance restart, or install AsyncOS 15.5.5-014 or 16.5.0-780.