CVE-2026-76519 exploited on Cisco email gateways
CVE-2026-76519 is being exploited against Cisco Secure Email Gateway appliances, according to a Cisco advisory. The vulnerability allows an unauthenticated sender, meaning someone without an account or login, to send an email with a specially prepared attachment and write files to the appliance's operating system. Successful exploitation could allow commands to run as root, the system account with the highest level of control. Cisco assigned the flaw a Critical CVSS severity score of 9.8, found it through internal security scanning and became aware of attacks in October. The advisory does not identify the attackers, quantify the affected devices or confirm whether any attacker obtained root access.
A gateway is vulnerable only when two conditions apply. File Reputation, part of the Advanced Malware Protection feature used to examine attachments, must be enabled and assigned to an incoming or outgoing mail policy. The installed Content Scanner Tools package must also be older than version 25.3.0.5525. Both physical and virtual Secure Email Gateway appliances running affected AsyncOS releases are exposed. AsyncOS is the operating software used by the appliance. Secure Email and Web Manager and Secure Web Appliance are not affected by this vulnerability.
Administrators can inspect the File Reputation setting under Mail Policies, Incoming Mail Policies, Advanced Malware Protection, or through the equivalent path for outgoing policies. The Content Scanner Tools version can be checked by running `contentscannerstatus` through the command-line interface, or CLI, which is a text-based administrative console. Systems already running version 25.3.0.5525 or later are not vulnerable through this flaw.
The scanner update is the fastest remediation route and does not require a complete software upgrade or restart. Appliances with automatic Content Scanner Tools updates enabled should receive it automatically, but administrators should verify the installed version rather than assume the update completed. Where automatic updates are disabled, Cisco says to run `contentscannerupdate` at the CLI or enable updates under Security Services and Service Updates. There is no workaround for an appliance that remains on an affected scanner version.
Cisco also lists AsyncOS 15.5.5-014 and 16.5.0-780 as the first fixed releases in their respective branches. No corrected build is listed for AsyncOS 16.0, so those systems must migrate to a fixed release or confirm that the separate scanner package is at version 25.3.0.5525 or later. Cisco recommends moving any gateway older than 16.5 to 16.5.0-780. AsyncOS 16.0.4-302, which corrected a separate SQL injection vulnerability disclosed in September, does not by itself fix CVE-2026-76519. The advisory does not identify which licensed and supported releases qualify for the scanner package, making the `contentscannerstatus` result the stated confirmation for a device that remains on 16.0.
Cisco provides a local check for signs of attempted exploitation: `grep "System Security" system_logs`. The result reports either a suspected compromise, an incomplete security scan or no indicator found. A suspected result requires the recovery process, while an incomplete scan should be referred to Cisco's Technical Assistance Center. Administrators should run the command on every appliance in a cluster. A clean result is not conclusive because an attacker with root control could conceal or remove evidence. Cisco therefore also advises checking firewall and other network logs stored outside the appliance for unexpected uploads to external internet addresses or downloads from malicious ones. The advisory does not explain precisely what its local scan detects.
Recovery depends on the appliance type. Cisco asks operators of compromised physical appliances to contact its Technical Assistance Center and enable remote access for investigation. For a virtual appliance, forensic data and logs should be preserved before any upgrade because updating the compromised instance destroys that evidence. Administrators should then deploy a new virtual machine on a fixed release, recreate its configuration without importing an old configuration file, renew credentials and cryptographic material, and continue monitoring for unusual activity.
Clustered gateways require additional attention. Members authenticate to one another using SSH key pairs, which are linked digital credentials used for trusted system connections. If an attacker obtains a compromised member's private keys, those credentials could provide access to other members. Cisco consequently recommends restoring every member of a cluster when at least one appliance is compromised. The company has also contacted managed Secure Email Cloud customers whose devices showed indicators of possible compromise. Cisco has deployed the corrected scanner package to that service, so no customer action is required to obtain the fix, although contacted customers are being asked to renew credentials and cryptographic material where possible. Managed-service administrators may not have the CLI access needed to perform the local check themselves.
The vulnerability was already covered by the hardening builds released on September 14, although it received its own advisory on Wednesday after Cisco confirmed exploitation. That hardening release grouped internally discovered defects by weakness class under CVE-2026-76440, CVE-2026-76441, CVE-2026-20353 and CVE-2026-76443, each scored 9.8, plus CVE-2026-76442 at 7.5. Cisco now says two defects from that release are being exploited: CVE-2026-76519 in the path traversal class, involving unsafe handling of file locations, and CVE-2026-76461 in the improper neutralization class. Cisco has not linked the two attack campaigns and says it is unaware of attacks against the other defects in the release.
CVE-2026-76461 is a SQL injection flaw in email parsing that can let an unauthenticated sender execute root commands through a crafted email. It affects every configuration and was added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on September 14. The two vulnerabilities involve different software components and require different log checks. Under Cisco's disclosure policy announced in June, defects in hardening releases can share grouped CVEs, while a flaw may receive a separate identifier when it is known to be exploited.
This is the third root-level Secure Email Gateway flaw Cisco has confirmed as exploited since December. Cisco Talos previously reported that the group it tracks as UAT-9686 used CVE-2025-20393 as a zero-day, meaning it was exploited before a fix was available, in the spam quarantine feature. Cisco patched that vulnerability in January. Organisations assessing their wider security posture can also consider the security-first IT, infrastructure and consulting offered by AEU-I.