Critical CVE-2026-76519 Lets Attackers Take Root Control of Cisco Email Gateways
Cisco confirms active exploitation of a critical vulnerability in Secure Email Gateway that allows unauthenticated remote root access via crafted attachments.
Key points
- CVE-2026-76519 is rated 9.8 critical and added to CISA's Known Exploited Vulnerabilities catalog on October 14, 2026.
- The flaw allows unauthenticated attackers to write arbitrary files and execute commands with root privileges on affected devices.
- Cisco has released updates for AsyncOS releases 15.5 and 16.5, as well as a standalone Content Scanner Tools update.
Attackers are actively exploiting a critical vulnerability in Cisco Secure Email Gateway that grants them full control over the appliance's operating system. Cisco confirmed on October 14, 2026, that the flaw, tracked as CVE-2026-76519, allows unauthenticated remote attackers to write arbitrary files and execute commands with root privileges. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on the same day, mandating federal agencies to address it by October 17, 2026.
The risk
The vulnerability resides in the Advanced Malware Protection feature, specifically within the file reputation service. According to the National Vulnerability Database, improper handling of email attachments enables attackers to bypass security checks. An attacker sends an email containing a crafted attachment through an affected gateway. If the device processes the attachment incorrectly, the attacker can write files to the underlying operating system. This leads to remote code execution with root privileges, effectively handing full control of the device to the attacker without requiring any login credentials.
Who is exposed
Cisco states that both physical and virtual gateways running vulnerable AsyncOS releases are affected. Specifically, AsyncOS Software for Cisco Secure Email Gateway Release 15.5 versions prior to 15.5.5-014 and Release 16.5 versions prior to 16.5.0-780 are at risk. The Secure Email and Web Manager Release 15.5 prior to 15.5.5-006 and Release 16.5 prior to 16.5.0-429 are also vulnerable. Secure Web Appliance devices are not affected. The flaw only impacts systems where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools package is older than version 25.3.0.5525.
Cost and compliance
CISA’s addition of CVE-2026-76519 to the KEV catalog triggers compliance requirements for federal agencies under Binding Operational Directive 26-04. Agencies must apply mitigations or discontinue use of the product if mitigations are unavailable. The Canadian Centre for Cyber Security echoed this urgency, encouraging administrators to apply updates immediately. Cisco has contacted customers of its managed Secure Email Cloud service showing indicators of compromise and is engaged in remediation. No specific financial costs or ransomware demands were reported in the source material.
What should you do?
Administrators should immediately verify if their File Reputation service is enabled and check their Content Scanner Tools version using the `contentscannerstatus` command in the CLI. If the scanner version is older than 25.3.0.5525, apply the standalone scanner update, which installs without a software upgrade or restart. For those running vulnerable AsyncOS versions, update to 15.5.5-014 or 16.5.0-780. Managed service customers need no action, as Cisco has already deployed fixes to their cloud infrastructure.
The background in plain language
Email gateways act as security checkpoints for incoming messages, scanning for malware before emails reach user inboxes. The file reputation service checks attachments against known threat databases. A relative path traversal flaw occurs when software fails to properly restrict where files are saved, allowing attackers to escape the intended storage folder and write to sensitive system directories. This bypasses normal access controls, granting the attacker the same privileges as the system administrator, often referred to as root access, enabling complete control over the device.
Background: Remote code execution vulnerabilities
Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.
Read the full guide: Remote Code Execution Risks and Protection for Small Businesses
What to do and how to stay safe: Cisco
- Check your email gateway's mail policies to see if the File Reputation service is enabled for incoming or outgoing mail.
- Run the `contentscannerstatus` command in the command line interface to determine the current version of your Content Scanner Tools.
- If your scanner version is below 25.3.0.5525, apply the available scanner update immediately to patch the vulnerability.
- If you use a managed cloud service, confirm with your provider that the underlying infrastructure has been updated by the vendor.
Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-76519 being exploited in the wild?
Yes, Cisco has confirmed that attackers are actively exploiting this vulnerability, and CISA has added it to the Known Exploited Vulnerabilities catalog.
Which Cisco products are affected by this vulnerability?
Cisco Secure Email Gateway and Secure Email and Web Manager are affected. Secure Web Appliance devices are not vulnerable.
Do I need to restart my device to apply the fix?
No, the Content Scanner Tools update can be installed without a software upgrade or a device restart.
