Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Cisco says attackers are exploiting critical Secure Email Gateway flaw CVE-2026-76519 to write files and gain root.
Cisco said attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway. An unauthenticated sender can email a crafted attachment, write files to the appliance operating system, and potentially run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped in AsyncOS 15.5.5-014 and 16.5.0-780, or Content Scanner Tools 25.3.0.5525 and later; release 16.0 has no fixed build. Cisco contacted managed Secure Email Cloud customers showing possible compromise indicators. Separately, September's SQL-injection flaw CVE-2026-76461 was exploited and added to CISA's KEV catalog.