A crafted attachment can let an attacker run commands as root on vulnerable appliances; Cisco urges affected operators to install a fixed scanner package or software release.
Cisco learned in October 2026 that attackers were exploiting CVE-2026-76519, a flaw in its Secure Email Gateway appliances. An attacker can send a crafted email attachment through a vulnerable gateway to write files and run commands as root, the operating system’s most powerful account. The attack does not require the attacker to sign in.
Cisco disclosed the flaw on October 14, and CERT-EU issued a warning on October 15. An October 28 BleepingComputer article highlighted it among exploited infrastructure flaws in Eclypsium’s InfraTrust Pulse report.
The flaw is in the gateway’s Advanced Malware Protection feature, which handles attachments improperly when File Reputation is enabled. CERT-EU says a physical or virtual gateway is vulnerable when it runs one of the AsyncOS versions below, File Reputation is enabled and assigned to a mail policy, and its Content Scanner Tools version is earlier than 25.3.0.5525.
CERT-EU rates the flaw critical, with a CVSS score of 9.8. It says the improper attachment handling involves relative path traversal in Advanced Malware Protection, allowing an unauthenticated remote attacker to write arbitrary files.
| AsyncOS branch | Affected versions |
|---|---|
| 15.5 |
Cisco says gateways are exposed only when File Reputation is enabled for a mail policy and the scanner is outdated. A fixed scanner update can close the flaw without a restart.
6 min
| Before 15.5.5-014 |
| 16.0 | Version 16.0 |
| 16.5 | Before 16.5.0-780 |
Administrators can inspect the File Reputation setting under Advanced Malware Protection in incoming or outgoing mail policies and check the installed Content Scanner Tools version. Version 25.3.0.5525 and later contains the fix; Cisco also distributes the fixed scanner package to licensed, supported AsyncOS releases. CERT-EU recommends updating the package or moving to a fixed AsyncOS release promptly, starting with appliances reachable from the internet.
Cisco recommends reviewing affected gateways’ system logs for suspected-compromise or incomplete-security-scan messages and checking external network and firewall logs for suspicious activity. An attacker with root access could hide evidence on the appliance.
If exploitation is suspected on a physical appliance, Cisco recommends contacting its technical support team. For a virtual appliance, it recommends preserving evidence before deploying a new virtual machine with a fixed release, rebuilding its configuration without importing the old files, and renewing credentials and cryptographic materials. Cisco warns that upgrading a compromised instance destroys forensic data and logs.
A compromised gateway could expose private SSH keys used to authenticate other gateways in its cluster. Cisco says those keys might allow an attacker to compromise other members, so it recommends restoring every member of a cluster containing a compromised appliance to a secure configuration.
Cisco says Secure Email Cloud Gateway customers need not install the fix because a fixed scanner version is already deployed. Separately, Cisco says it has contacted cloud customers whose devices showed signs of possible compromise and recommends that those contacted renew credentials and cryptographic materials where possible. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected by this flaw.
