Cisco says attackers are actively exploiting a critical vulnerability in its Secure Email Gateway that can let an unauthenticated remote attacker write files and run commands as root. The company disclosed the flaw on Oct. 14, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day. [1] [2]
The issue, tracked as CVE-2026-76519, has a CVSS score of 9.8. Cisco describes it as an arbitrary-file-write vulnerability in the Advanced Malware Protection (AMP) feature. An attacker can send an email with a crafted attachment through an affected gateway; successful exploitation can lead to root-level command execution on the device. [1]
The vulnerable setup is specific
This is not a flaw in every Cisco email gateway. Cisco says a Secure Email Gateway is affected only when both of these conditions are true: AMP File Reputation is enabled and assigned to a mail policy, and the Content Scanner Tools package is earlier than version 25.3.0.5525. Cisco lists both physical and virtual appliances among the potentially affected products. [1]
Cisco says it became aware of active exploitation in October but has not publicly detailed the attackers or the scale of the activity. CISA’s catalog says the flaw is known to be exploited and marks forensic triage as required; it does not attribute the activity to ransomware campaigns. [1] [3]
What administrators should know
Cisco says there is no workaround. The fix is included in Content Scanner Tools 25.3.0.5525 and later. Cisco also lists fixed AsyncOS releases 15.5.5-014 and 16.5.0-780; customers on 16.0 must move to a fixed release. Cisco says the scanner-tools update can be installed without a software upgrade or product restart, and customers with automatic updates should verify that the fixed version has applied. [1]
CISA’s Oct. 17 due date applies to federal civilian executive-branch agencies under its vulnerability-management directive, not to every organization. CISA encourages other organizations to prioritize KEV vulnerabilities as well. Cisco warns that attackers with root access may conceal evidence, so patch status alone may not settle whether an appliance was compromised; the company recommends reviewing external network and firewall logs and contacting Cisco support when compromise is suspected. [1] [2] [3]