Cisco urges Secure Email Gateway checks after active CVE-2026-76519 attacks
Cisco has warned that attackers are actively exploiting CVE-2026-76519, a critical vulnerability in Cisco Secure Email Gateway with a CVSS score of 9.8. A sender without a login can send an email carrying a crafted attachment through the gateway and write files to the appliance operating system; successful exploitation could lead to commands being executed as root.
The issue affects physical and virtual Secure Email Gateway appliances only when two conditions are met: the File Reputation service is enabled and assigned to a mail policy, and Content Scanner Tools is older than version 25.3.0.5525. Cisco found the flaw through internal security scanning and said it became aware of attacks in October, without disclosing the number of affected devices, the attackers, or whether root access was obtained.
Updates are available without a restart
Cisco says the fastest remediation path is Content Scanner Tools version 25.3.0.5525 or later. The scanner update installs without a software upgrade or restart. Administrators with automatic scanner updates enabled should still use the contentscannerstatus command to verify that the installed version is 25.3.0.5525 or newer.
Where automatic updates are disabled, administrators can run contentscannerupdate at the command line or enable updates under Security Services > Service Updates. The first fixed AsyncOS builds listed by Cisco are 15.5.5-014 for the 15.5 train and 16.5.0-780 for 16.5. There is no fixed 16.0 build, and Cisco recommends moving gateways earlier than 16.5 to 16.5.0-780.
Exposure and compromise checks
Teams can confirm whether File Reputation is active by opening Mail Policies, selecting Incoming Mail Policies or Outgoing Mail Policies, then reviewing Advanced Malware Protection for the relevant policy. The Content Scanner Tools version and its most recent update time are available through contentscannerstatus. Secure Email and Web Manager and Secure Web Appliance are not affected.
Cisco provides a local check for attempted exploitation: grep "System Security" system_logs. It should be run on every cluster member. A result showing no compromise indicator does not rule out an intrusion, because an attacker with root access might remove or conceal evidence. Cisco advises checking firewall and network logs outside the appliance for unexpected uploads to external IP addresses or downloads from malicious ones.
Recovery requires evidence preservation
For a physical appliance that shows compromise indicators, Cisco asks customers to contact Technical Assistance Center support and enable remote access for investigation. For a virtual appliance, the company advises preserving forensic data before any action, because upgrading a compromised instance destroys logs and other evidence. The recovery path is to deploy a new virtual machine on a fixed release, rebuild configuration without importing the old configuration file, and renew credentials and cryptographic material.
The cluster risk is material because members use SSH key pairs to authenticate with one another. Cisco recommends restoring every member of a cluster containing a compromised appliance, since a stolen private key could provide a route into peers. The incident follows September's exploited SQL injection issue, CVE-2026-76461; Cisco vulnerability activity alongside other threats places that earlier Cisco vulnerability activity alongside other threats that security teams were tracking.
For businesses running these gateways, the immediate priority is to verify the scanner version rather than assume automatic updates succeeded, inspect every cluster member, and preserve evidence before rebuilding any suspected compromised virtual appliance.