Cisco patches exploited root-access flaw in Secure Email Gateway

Cisco patches exploited root-access flaw in Secure Email Gateway

14 October 2026: Cisco has fixed CVE-2026-76519, a critical flaw (CVSS 9.8) in the Advanced Malware Protection feature of Secure Email Gateway. An unauthenticated attacker can send an email with a crafted attachment, write arbitrary files and run commands as root. Cisco's PSIRT says it learned of active exploitation in October 2026, and there is no workaround.

Which appliances are vulnerable

Both physical and virtual gateways are affected when two conditions hold. The File Reputation service, part of Cisco AMP, must be enabled and assigned to a mail policy, and the Content Scanner Tools version must be earlier than 25.3.0.5525.

To check, run the contentscannerstatus command at the CLI and read the Content Scanner Tools line. Then open Mail Policies, choose Incoming or Outgoing Mail Policies, then Advanced Malware Protection, pick a policy and see whether Enable File Reputation is ticked. Secure Email and Web Manager and Secure Web Appliance are confirmed not vulnerable.

Two ways to the fix

The fix reaches every licensed and supported AsyncOS release through an updated Content Scanner Tools package, so a full software upgrade is not required and the appliance does not need a restart. Customers with automatic updates on need do nothing once the update lands. Others should run contentscannerupdate at the CLI, or enable automatic updates under Security Services, Service Updates.

Cisco also names fixed AsyncOS releases and advises anyone on a release earlier than 16.5 to migrate to 16.5.0-780:

• 15.5: 15.5.5-014
• 16.0: migrate to a fixed release
• 16.5: 16.5.0-780

Secure Email Cloud customers need take no action. Cisco has deployed protections in its infrastructure and has contacted cloud customers where it found signs of compromise.

Checking for compromise before you patch

Cisco's advisory describes a log check: run grep "System Security" system_logs on each cluster member. A "Suspected compromise indicator was found" line means contact the Cisco Technical Assistance Center. "Security scan did not complete" also means contact support.

Cisco warns that root access lets an attacker hide evidence on the device, so firewall and network logs outside it should be reviewed for unexpected uploads to external addresses. On a suspected virtual appliance, record forensics first, because upgrading a compromised instance destroys logs. The advisory then recommends deploying a new virtual machine on a fixed release, rebuilding the configuration without importing old files and renewing credentials. Cluster members share SSH key pairs that an attacker could read, so Cisco says to restore every member of a cluster that contains one compromised appliance.

BleepingComputer counts nearly 300 gateways exposed online, per Shadowserver, and notes this is the second exploited Secure Email Gateway flaw in about a month. Our email security software category lists 11 products.

Sources

• Cisco: Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp), 14 October 2026
• BleepingComputer: Cisco patches new Secure Email Gateway zero-day exploited in attacks, 14 October 2026