Cisco Warns Critical Secure Email Gateway Flaw Actively Exploited for Root Access

Cisco confirmed Wednesday that a critical vulnerability in its Secure Email Gateway (CVE-2026-76519) is under active exploitation, allowing unauthenticated attackers to write files to the appliance's OS and execute root commands via a crafted email attachment. The flaw, which carries a maximum CVSS score of 9.8, impacts gateways that have the File Reputation service enabled and are running a Content Scanner Tools package older than version 25.3.0.5525. Cisco identified the vulnerability during internal security scanning and became aware of active attacks in October, though the advisory did not specify the number of affected devices or the identity of the attackers. The company has already applied fixes for its managed Secure Email Cloud service and is urging administrators of physical and virtual gateways to install the 25.3.0.5525 scanner update or migrate to fixed AsyncOS releases like 15.5.5-014 and 16.5.0-780. For virtual appliances showing signs of compromise, Cisco advises rebuilding the instance with new credentials rather than upgrading, as an upgrade destroys forensic data and logs.