Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
On 14 October 2026, Cisco disclosed a critical vulnerability in Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8) and confirmed that it is being actively exploited. The flaw is in the File Reputation service, part of Cisco Advanced Malware Protection. An unauthenticated, remote attacker can send an email with a crafted attachment that writes arbitrary files to the appliance and runs commands with root privileges. Physical and virtual gateways are affected when File Reputation is enabled on a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525. There is no workaround. Cisco has already fixed its Secure Email Cloud Gateway service, and Secure Email and Web Manager and Secure Web Appliance are not affected.
What to do:
- Patch: update Content Scanner Tools to 25.3.0.5525 or later (no software upgrade or restart needed), or upgrade AsyncOS to 15.5.5-014 or 16.5.0-780. Appliances on 16.0 must migrate to a fixed release.
- Check for compromise: run grep “System Security” system_logs on every appliance in a cluster, and review firewall and network logs for unexpected uploads from the gateway or downloads from suspicious addresses. If you find signs of compromise, contact Cisco TAC; on virtual appliances, preserve evidence before rebuilding.
- Restrict exposure: the attack arrives in ordinary inbound email, so network restrictions will not stop it. Check which mail policies have File Reputation enabled and patch internet-facing gateways first.
Source: Cisco Security Advisory: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
If you would like help assessing your exposure, contact us.
