CriticalMalware
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
The Hacker News·Source published ·1 min read
What happened?
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Key details
- Only gateways with File Reputation service enabled and Content Scanner Tools older than 25.3.0.5525 are vulnerable.
- Cisco released fixes on September 14 in AsyncOS 15.5.5-014 and 16.5.0-780.
- Content Scanner Tools update to version 25.3.0.5525 or later fixes the flaw without software upgrade.
- CVE-2026-76519 is the third confirmed exploited root-level flaw in these appliances since December 2025.
- Cisco advises rebuilding virtual appliances from scratch if compromised, preserving forensic data first.
Affected
- Gateways with File Reputation service enabled and Content Scanner Tools before 25.3.0.5525.
Fixes and mitigations
- Update Content Scanner Tools to version 25.3.0.5525 or later via CLI or automatic updates.
What to look for
- Check firewall and network logs for unexpected external IP uploads or downloads.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.