Cisco Secure Email Gateway flaw under active exploitation lets crafted attachments write files and gain root

Cisco warned of active attacks exploiting CVE-2026-76519, a flaw rated 9.8 in Secure Email Gateway, found during its own internal security scanning. A sender with no login can email a crafted attachment through the gateway to write files to the appliance operating system, after which an attacker could run commands as root. Both the File Reputation service enabled on a mail policy and a Content Scanner Tools version earlier than 25.3.0.5525 must be present. Cisco's advisory lists this file-write flaw and a September SQL injection flaw as actively exploited. Fixes shipped since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, plus Content Scanner Tools 25.3.0.5525.

Check

Check Secure Email Gateways for the File Reputation service on a mail policy and Content Scanner Tools below 25.3.0.5525, then upgrade AsyncOS and the scanner tools immediately.

Affected

Vulnerable Cisco Secure Email Gateways let an unauthenticated sender write files via a crafted attachment and then run commands as root, and attacks are already occurring.

Fix

Upgrade to fixed AsyncOS builds and Content Scanner Tools 25.3.0.5525 or later, review appliances for unexpected files and root activity, and restrict administrative access.