Cisco Secure Email Gateway Zero-Day Exploited Again

A Cisco Secure Email Gateway zero-day is under attack: one email with a crafted attachment lets an unauthenticated attacker write files and run commands as root. Cisco tracks it as CVE-2026-76519 (CVSS 9.8), and CISA added it to the Known Exploited Vulnerabilities catalog on October 14. It is the second Secure Email Gateway flaw exploited in a month, and the build that fixed the first one on AsyncOS 16.0 does not fix this one.

What Happened

Cisco published its advisory on October 14. CVE-2026-76519 is a relative path traversal in the way the Advanced Malware Protection feature handles email attachments. A gateway is exposed only if File Reputation is enabled and assigned to a mail policy and the Content Scanner Tools package is older than 25.3.0.5525. Cisco found the flaw in its own scanning and learned of attacks in October. As of writing, it does not say how many devices were hit, who is behind the attacks or whether they got root. CISA set a federal deadline of October 17, and Germany’s BSI issued a high-criticality warning on October 15.

This Cisco Secure Email Gateway zero-day follows CVE-2026-76461, the SQL injection we covered on September 17. Cisco shipped the fix for the new flaw in September, inside a hardening release published the same day as the SQL injection fix, and gave it its own advisory only after attacks began. The fixed builds are AsyncOS 15.5.5-014 and 16.5.0-780. There is no fixed 16.0 build, and 16.0.4-302, the build that closed the September flaw, does not close this one. A Content Scanner Tools update to 25.3.0.5525 or later fixes the flaw without a software upgrade or restart. Check the Cisco advisory for current mitigation guidance.

Why It Matters

An email gateway sees every inbound message. Root on it means an attacker can read or alter mail in transit and has a foothold inside the perimeter, and cluster members trust each other through SSH keys. This is also the third root-level flaw in these appliances that Cisco has confirmed exploited since December, after CVE-2025-20393 (used by a China-linked group tracked as UAT-9686) and CVE-2026-76461.

Cisco’s grouped hardening releases make exposure hard to read: the fix sat inside an umbrella advisory for a month before the flaw had its own CVE. Gateways that took the September builds on 15.5 or 16.5 were covered before the attacks began; gateways on 16.0 were not. For DACH we know of no German victims. Assessment: the BSI warning and the product’s place at the mail edge of mid-sized and financial-sector networks make this a priority patch item.

What You Should Do Now

1. Check exposure. In the web interface, open Mail Policies, Incoming Mail Policies, Advanced Malware Protection and look at the Enable File Reputation box, then run contentscannerstatus at the CLI. A version below 25.3.0.5525 with File Reputation on is exposed. Sources disagree on whether Secure Email and Web Manager is affected, so check Cisco’s advisory for it.
2. Update the scanner. Run contentscannerupdate or turn on automatic updates under Security Services, Service Updates, then confirm the version with contentscannerstatus. Then move to 15.5.5-014 or 16.5.0-780; a 16.0 gateway should migrate to 16.5.0-780.
3. Hunt for compromise on every cluster member: run grep “System Security” system_logs. A clean result is not proof, because an attacker with root can remove traces, so also check firewall logs for unexpected uploads to external addresses.
4. If a virtual gateway shows signs of compromise, preserve forensic data first, because upgrading destroys logs. Deploy a new virtual machine on a fixed release, rebuild the configuration without importing the old file and renew credentials and cryptographic material. For physical appliances contact Cisco TAC. Restore every cluster member if one is compromised.

DIESEC Perspective

Track the fixed build of each appliance rather than waiting for a CVE headline, and keep the scanner package on automatic updates: it is the one component here you can fix without a maintenance window.

Not sure whether your mail gateways run File Reputation with an outdated scanner package? Contact DIESEC for a rapid exposure and compromise assessment of your email security appliances.

Sources: The Hacker News | Cisco advisory | BSI | Canadian Cyber Centre | Security Affairs
Published: 2026-10-19 | Category: Vulnerabilities & Patches | ~4 min read