Cisco Secure Email Gateway Under Attack: A Critical Flaw You Need to Check Now
Email gateways sit at the front door of an organization’s inbox, filtering spam, malware and other threats before they reach employees. When that front door has a flaw, an attacker needs nothing more than a single email to get in, and that is what Cisco is now warning about.
What happened
Cisco says attackers are actively exploiting a critical flaw in its Secure Email Gateway, tracked as CVE-2026-76519 and scored 9.8 out of 10. An unauthenticated attacker can send an email with a crafted attachment through the gateway and write files to the appliance’s operating system. If that succeeds, the attacker could go on to run commands as root, which is full control of the device. Cisco found the bug in its own internal security scanning and learned of the attacks in October. It has not said how many devices were hit, who is behind the attacks, or whether any attacker actually gained root.
Who is exposed
A gateway is vulnerable only when two conditions are both true. The File Reputation service, part of the Advanced Malware Protection feature that handles attachments, must be enabled and assigned to a mail policy, and the Content Scanner Tools package must be older than version 25.3.0.5525. Both physical and virtual gateways on vulnerable AsyncOS releases are affected, while Secure Email and Web Manager and Secure Web Appliance are not. Administrators can check the first condition in the Advanced Malware Protection settings of their mail policies and the second by running the contentscannerstatus command at the command line.
How to fix it
The fastest fix is a Content Scanner Tools update to version 25.3.0.5525 or later, which installs without a software upgrade or a restart. If automatic updates are off, administrators can run contentscannerupdate or turn automatic updates on in the Service Updates settings. They should then confirm the version rather than assuming the update arrived. The complete fix is also included in AsyncOS 15.5.5-014 and 16.5.0-780, which Cisco has been shipping since September 14 as part of a hardening release. There is no fixed build for the 16.0 line, so those gateways should either migrate to a fixed release or rely on the scanner update. Cisco says there is no workaround.
How to check for compromise
Cisco gives a simple check for attempted exploitation: search the appliance’s system logs for the phrase “System Security.” The result will say that a suspected compromise indicator was found, that the scan did not complete, or that no compromise indicator was found, and it should be run on every member of a cluster. A clean result is not proof of safety, because an attacker with root could erase evidence. Administrators should also review firewall and network logs outside the device for unexpected uploads to external addresses or downloads from malicious ones. Customers of Cisco’s managed Secure Email Cloud service have already received the fixed scanner, and Cisco has contacted those whose devices showed possible signs of compromise.
If a device is compromised
For a physical appliance, Cisco asks customers to contact its Technical Assistance Center and enable remote access for investigation. For a virtual appliance, the steps are to preserve forensic data first, because upgrading a compromised instance destroys logs and evidence, then deploy a new virtual machine on a fixed release, rebuild the configuration without importing the old file, and renew all credentials and cryptographic material. Cluster members trust each other through SSH key pairs, so a compromised member could open the way into the others, and Cisco recommends restoring every member of a cluster that contains at least one compromised appliance.
Not the first warning this month
This is the second Secure Email Gateway flaw that Cisco has confirmed under attack in about a month. On September 14 it disclosed CVE-2026-76461, a SQL injection flaw in email parsing that also allows unauthenticated attackers to run commands as root, and CISA added it to its Known Exploited Vulnerabilities catalog the same day. Cisco has not linked the two sets of attacks. The newer flaw was actually fixed in September inside a grouped hardening release, and it received its own advisory only after Cisco learned it was being exploited. Going back further, Cisco confirmed another root-level flaw in these appliances in December, when a China-linked group tracked as UAT-9686 exploited a zero-day in the spam quarantine feature. That makes three exploited root-level flaws in the product line since December.
Final thoughts
Email security appliances are attractive targets because they are internet-facing, trusted and often run with high privileges. The practical lessons are to check the Content Scanner Tools version today, run the compromise check on every device, and not to treat a patch as the end of the job if exploitation may have already happened. It is also worth remembering that a bundled hardening release can hide a serious bug among many fixes, so applying vendor updates promptly matters even when an advisory looks routine.
Comments