Cisco patches exploited 9.8-rated Secure Email Gateway flaw
CVE-2026-76519 lets an attacker take over the appliance with one crafted email, and Cisco says updating is the only fix.
Cisco published a security advisory on Oct. 14 about CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway, the appliance that screens an organization's incoming mail before it reaches inboxes. The company says its incident response team learned in October that the flaw was already being exploited.
It is a zero-day: it was used in attacks before a patch existed. Cisco rates it 9.8 out of 10. According to the advisory, an attacker with no account can write files and run commands with the highest administrator privileges (root) on the device just by sending an email with a manipulated attachment. The bug sits in how the anti-malware module handles attachments.
The four key facts
| Item | Detail |
|---|---|
| Identifier | CVE-2026-76519 |
| Product | Secure Email Gateway, physical and virtual, if File Reputation is enabled in a mail policy and Content Scanner Tools is older than 25.3.0.5525 |
| Patch | AsyncOS 15.5.5-014 on the 15.5 branch and 16.5.0-780 on 16.5; the 16.0 branch must migrate to a fixed release |
| Workaround | None, according to Cisco |
Cisco says Content Scanner Tools 25.3.0.5525 or later also carries the fix and installs without upgrading the system or restarting. Secure Email and Web Manager and Secure Web Appliance are not affected.
BleepingComputer reports that Cisco has already applied mitigations to its cloud instances and contacted Secure Email Cloud customers where it found possible compromise. According to that outlet, Shadowserver, which tracks devices exposed on the internet, counts nearly 300 Secure Email Gateway instances reachable from the network, without saying how many are decoys or already protected.
The people who run these appliances are the IT departments of companies, universities and governments, not end users. Because the device sees all of an organization's email, whoever controls it could reach the messages passing through.
Who is exploiting the flaw and which organizations were targeted has not been reported, and there is no data on affected devices in Mexico. BleepingComputer notes that the product has had two other exploited flaws, CVE-2025-20393 and CVE-2026-76461, both separate from this one.
