Cisco says gateways are exposed only when File Reputation is enabled for a mail policy and the scanner is outdated. A fixed scanner update can close the flaw without a restart.
Cisco warned on 14 October that attackers are exploiting a critical vulnerability in Secure Email Gateway, according to The Hacker News. The US Cybersecurity and Infrastructure Security Agency, known as CISA, confirmed the flaw's addition to its Known Exploited Vulnerabilities catalog in a 14 October alert, placing it within a federal policy that prioritizes repairs according to risk.
The gateway filters an organization's email for spam, malware and other threats. Cisco's fixed AsyncOS software builds shipped on 14 September in a hardening release that the company says covered this flaw. Cisco became aware of active exploitation in October.
CISA's alert identifies CVE-2026-76519, the tracking number for the Cisco flaw, as one of four additions to its Known Exploited Vulnerabilities (KEV) catalog. The agency says the additions are based on evidence of active exploitation.
Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk, applies only to US federal civilian executive branch agencies. It requires those agencies to prioritize rapid remediation of high-risk, catalog-listed vulnerabilities on publicly exposed systems when exploitation gives attackers total control of the system. Agencies must defer action on lower-risk vulnerabilities under that approach.
CISA says the directive also sets basic expectations for when agencies must check whether attackers compromised a system before its patch was applied. The requirement distinguishes closing a vulnerability from investigating access attackers may already have gained.
The directive does not bind organizations outside that federal scope. CISA nevertheless encourages all organizations to manage vulnerabilities according to risk and prioritize remediation of flaws in the KEV catalog.
A crafted attachment can let an attacker run commands as root on vulnerable appliances; Cisco urges affected operators to install a fixed scanner package or software release.
3 min
Cisco says it has deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where it found evidence of potential compromise, BleepingComputer reported on 14 October. The company has already installed the fixed scanner on its managed cloud gateways, so those customers need no action to obtain the fix. Their administrators may not have the command-line access needed to run the compromise check.
Cisco says it is carrying out remediation and recovery for potentially compromised cloud devices. It strongly recommends that contacted customers restore a secure configuration by renewing credentials and cryptographic materials, such as security keys, installed on the appliance where possible. Cisco also recommends restricting access to the appliance and implementing strong access controls.
The software fix closes the vulnerability, while Cisco's recovery guidance addresses devices that may already have been compromised. Cisco advises checking firewall and network logs for suspicious activity, including uploads and downloads to or from external or suspicious IP addresses. Attackers able to run commands as root—the operating system's highest administrator privilege—may erase evidence of exploitation.
The vulnerability has a severity score of 9.8 out of 10. It stems from improper handling of email attachments in Advanced Malware Protection, Cisco's attachment protection feature. An attacker needs no login: sending a crafted attachment through a vulnerable gateway could allow the attacker to write files to its operating system and execute commands as root.
Physical and virtual gateways running vulnerable AsyncOS releases are affected only when both conditions apply:
Secure Email and Web Manager and Secure Web Appliance are not affected by this flaw.
Content Scanner Tools version 25.3.0.5525 or later fixes the vulnerability without an AsyncOS upgrade or a restart. Cisco makes the scanner update available for licensed and supported AsyncOS releases. There is no workaround.
Cisco also recommends that customers running AsyncOS releases earlier than 16.5 migrate to 16.5.0-780, The Register reported on 14 October. That recommendation does not replace the scanner-only route for closing this flaw.
| Software branch or component | First fixed version or required action |
|---|---|
| AsyncOS 15.5 | 15.5.5-014 |
| AsyncOS 16.0 | No fixed AsyncOS build; migrate to a fixed release |
| AsyncOS 16.5 | 16.5.0-780 |
| Content Scanner Tools on licensed and supported AsyncOS releases | 25.3.0.5525 or later |
AsyncOS 16.0.4-302, which fixed September's separate SQL injection flaw, does not fix this vulnerability. SQL injection lets an attacker interfere with database commands. Cisco has not specified which releases qualify as licensed and supported for the scanner update. For a gateway kept on 16.0, administrators need to verify the installed scanner version.
Administrators should run contentscannerstatus in the command-line interface to confirm version 25.3.0.5525 or later, even if automatic updates are enabled. Where automatic updates are disabled, administrators can run contentscannerupdate or enable automatic updates under Security Services > Service Updates.
To check the other exposure condition, inspect the Enable File Reputation checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection, or the corresponding Outgoing Mail Policies settings, in the web management interface.
Cisco advises running its system-log compromise check on every member of a cluster—a group of connected gateways. A result showing no indicator is not proof that a device is safe, because an attacker with root access could remove or hide evidence. Administrators should also examine firewall and network logs outside the gateway.
| System-log message | Recommended action |
|---|---|
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations. | Follow Cisco's recovery recommendations and contact its Technical Assistance Center. |
System Security: Security scan did not complete. Contact TAC for further recommendations. | Contact Cisco's Technical Assistance Center for support. |
System Security: No compromise indicator was found. | Upgrade to a fixed software release if applicable; also check external logs because evidence may have been erased. |
For a virtual gateway showing signs of compromise, Cisco warns that upgrading the compromised instance destroys its logs and forensic evidence. Its recovery guidance is to:
Cluster members authenticate to one another using Secure Shell (SSH) key pairs, which establish trusted connections between devices. A private key stolen from one compromised gateway could let an attacker access the others, so Cisco recommends restoring every member of a cluster containing a compromised appliance. For a compromised physical appliance, Cisco asks customers to contact its Technical Assistance Center and enable remote access so engineers can investigate.
A Cisco spokesperson confirmed active exploitation to The Register and said the vulnerability affects “a limited number of customers.” Cisco declined to disclose how many appliances had been compromised or what attackers were doing with their access. The company has not identified the attackers or said whether any obtained root access.
The Register reported on 14 October that federal agencies must fix this vulnerability by 17 October under CISA's deadline. CISA's directive applies to federal civilian executive branch agencies, whose next step is to remediate affected systems and assess whether they were compromised before patching.
