Cisco on Wednesday warned customers that hackers have been exploiting a critical-severity vulnerability in Secure Email Gateway.
Tracked as CVE-2026-76519 (CVSS score of 9.8/10), the security defect impacts the Advanced Malware Protection (AMP) feature of the appliance and could allow remote, unauthenticated attackers to write arbitrary files on the operating system.
“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” Cisco warns.
The flaw exists in the handling of email attachments if the file reputation service has been enabled and if a Content Scanner Tools version earlier than 25.3.0.5525 is installed.
Attackers could send emails containing crafted attachments to trigger the security hole, write arbitrary files on the underlying OS, and execute arbitrary commands with root privileges.
Cisco has published indicators of compromise (IoCs) to help organizations hunt for potential intrusions, but warns that attackers may abuse their elevated access to remove or hide evidence of exploitation.
Organizations should check network and firewall logs outside of the affected devices to discover suspicious activity such as unexpected uploads or downloads to and from external IP addresses.
Cisco has advised customers to contact its Technical Assistance Center (TAC) if they suspect exploitation on a physical device.
For virtual appliances, it has recommended deploying a new VM running a fixed software release, rebuilding product configuration from scratch, and rotating credentials, while preserving forensic evidence.
“Cisco has directly contacted customers who own Cisco Secure Email Cloud devices where indicators of possible compromise were identified. Cisco is engaged in remediation and recovery operations. Cisco has already deployed mitigations that are within Cisco’s management,” the company notes.
Cisco customers should migrate to a patched AsyncOS software release as soon as possible. Fixes for CVE-2026-76519 were rolled out on September 14, in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780.
At the time, Cisco grouped this vulnerability and others under CVE-2026-76440. On Wednesday, it updated the September advisory to mention the flaw’s in-the-wild exploitation.
CVE-2026-76519 is the second Cisco Secure Email Gateway vulnerability exploited in the wild since mid-September, after CVE-2026-76461, another unauthenticated bug that could lead to command execution with root privileges.
On Wednesday, the US cybersecurity agency CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by October 17.
Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Related: Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Related: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Related: SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
