Cisco Secure Email Gateway taken over by a single crafted email attachment (CVE-2026-76519)

25 October 2026Critical 9.8Being exploited

Cisco · Cisco Secure Email Gateway · CVE-2026-76519

Cisco Secure Email Gateway taken over by a single crafted email attachment

When the File Reputation service is on, a crafted attachment sent through the gateway can let a remote, unauthenticated attacker write files and run commands as root. Cisco became aware of active exploitation in October 2026, and there is no workaround.

Affected: Cisco Secure Email Gateway (physical and virtual) running vulnerable AsyncOS releases, with File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected.
What to do: Make sure Content Scanner Tools is at 25.3.0.5525 or later, and move to AsyncOS 15.5.5-014 or 16.5.0-780 (16.0 users should migrate to a fixed release).General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited; on CISA's KEV list; attackers only need to send an email to reach it.

Cisco Secure Email Gateway taken over by a single crafted email attachment

Affected

Cisco Secure Email Gateway (physical and virtual) running vulnerable AsyncOS releases, with File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected.

What to do

Make sure Content Scanner Tools is at 25.3.0.5525 or later, and move to AsyncOS 15.5.5-014 or 16.5.0-780 (16.0 users should migrate to a fixed release).General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited; on CISA's KEV list; attackers only need to send an email to reach it.