SecOraLens
CriticalZero-DayCVE-2026-76519

Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

Cyber Security News·Source published ·1 min read

What happened?

Cisco has warned that attackers are actively exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway that can give them root access to affected appliances. Tracked as CVE-2026-76519, the flaw carries a CVSS score of 9.8 and allows attacks through specially crafted email attachments without requiring a login. Cisco published its advisory on October 14, 2026. The company said its security response team became aware of active exploitation in October.

Key details

  • Attackers are actively exploiting a critical zero-day in Cisco Secure Email Gateway that grants root access without authentication.
  • Both physical and virtual appliances running vulnerable AsyncOS are affected when File Reputation is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525.
  • Cisco Secure Email and Web Manager and Secure Web Appliance are not impacted by this vulnerability.
  • Cisco recommends checking system logs with grep for "System Security" and reviewing firewall and network logs for unexpected gateway traffic.
  • Patching closes the vulnerability but does not confirm whether attackers previously gained access; investigation and evidence preservation are advised.

Affected

  • Cisco Secure Email Gateway physical and virtual appliances running vulnerable AsyncOS with File Reputation enabled and Content Scanner Tools older than 25.3.0.5525.

Fixes and mitigations

  1. Update Content Scanner Tools to version 25.3.0.5525 or later via contentscannerupdate command; no full upgrade or restart required.
  2. Secure Email Cloud Gateway customers already have the corrected package deployed automatically.

What to look for

  • Unexpected uploads from the gateway or downloads from suspicious addresses in firewall and network logs.
  • Incomplete security scan results requiring Cisco TAC support.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories