AsyncOS (Product): news timeline & CVEs

Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

Cisco says attackers are exploiting an unauthenticated root zero-day in Secure Email Gateway.

Cisco PSIRT said attackers were actively exploiting a zero-day in the AMP File Reputation feature of Cisco Secure Email Gateway in October 2026, tracked as advisory cisco-sa-esa-afw-zqYJkjxp. An unauthenticated attacker can send a crafted email attachment to write arbitrary files and run commands as root; the supplied text includes no CVE or CVSS score. Appliances are affected when File Reputation is enabled on a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. The fix is Content Scanner Tools 25.3.0.5525 or later, with no workaround; Secure Email and Web Manager and Secure Web Appliance are not vulnerable.

GBHackersOct 15, 15:12 UTC · 1d agoExploit / PoC in the wild 12 sources1· 1 read

Cisco warns of actively exploited Secure Email Gateway flaw

Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to run root commands via crafted attachments.

Cisco confirmed active exploitation of CVE-2026-76519 in physical and virtual Secure Email Gateway appliances running vulnerable AsyncOS. When File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, a specially crafted email attachment can write arbitrary files and execute commands as root. Fixed releases are AsyncOS 15.5.5-014 and 16.5.0-780; customers on 16.0 should migrate, and Content Scanner Tools 25.3.0.5525 can be updated without a restart. Cisco said attackers could obtain cluster SSH keys and hide evidence, and it has already updated Secure Email Cloud Gateway. No victim count or attacker identity was disclosed.

CSO Onlineupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 12:32 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to write files and run commands as root.

Cisco confirmed attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in the Advanced Malware Protection file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root when File Reputation is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Updating the scanner does not require a product restart; AsyncOS fixes are 15.5.5-014 and 16.5.0-780, while 16.0 has no fix. Cisco-managed Secure Email Cloud is already protected. Cisco says this is the third exploited email-gateway root flaw since December 2025 and warns attackers may hide evidence, so external firewall and network logs should be checked.

Security Affairsupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 09:27 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco says attackers are exploiting critical unauthenticated CVE-2026-76519 in Secure Email Gateway for root access.

Cisco warned that CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway Advanced Malware Protection is under active exploitation. Unauthenticated attackers can send crafted attachments, when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, to write arbitrary files and run commands as root. Fixes released September 14 in versions 15.5.5-014 and 16.5.0-780 were originally grouped under CVE-2026-76440. CISA added the flaw to KEV with an October 17 federal deadline; it follows exploited CVE-2026-76461.

SecurityWeekupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 06:34 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519 CVE-2026-76440 CVE-2026-76461

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Cisco says attackers are exploiting critical Secure Email Gateway flaw CVE-2026-76519 to write files and gain root.

Cisco said attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway. An unauthenticated sender can email a crafted attachment, write files to the appliance operating system, and potentially run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped in AsyncOS 15.5.5-014 and 16.5.0-780, or Content Scanner Tools 25.3.0.5525 and later; release 16.0 has no fixed build. Cisco contacted managed Secure Email Cloud customers showing possible compromise indicators. Separately, September's SQL-injection flaw CVE-2026-76461 was exploited and added to CISA's KEV catalog.

The Hacker Newsupdated Oct 15, 15:12 UTC · 1d agofirst Oct 14, 18:38 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-76519 CVE-2026-76461

Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation

Cisco warns CVE-2026-76461 (CVSS 9.8), an unauthenticated root RCE in Secure Email Gateway AsyncOS, is actively exploited in the wild.

Cisco confirmed that CVE-2026-76461, a CVSS 9.8 email-parsing flaw in Secure Email Gateway AsyncOS, is being exploited in the wild since September 2026, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted emails containing malicious SQL statements. All physical and virtual SEG configurations are affected; Secure Email and Web Manager and Secure Web Appliance are not. CISA added the flaw to the KEV catalog with a September 17 federal remediation deadline, and Cisco released IoCs while noting root access lets attackers remove them.

SecurityWeekSep 15, 05:18 UTC · Sep 15, 2026Exploit / PoC in the wildCVE-2026-76461 CVE-2025-20393 CVE-2026-20079+1 CVEs3

AsyncOS

Timeline6 articles

Related CVEsby mentions

Appears with