Content Scanner Tools (Product): news timeline & CVEs

Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

Cisco says attackers are exploiting an unauthenticated root zero-day in Secure Email Gateway.

Cisco PSIRT said attackers were actively exploiting a zero-day in the AMP File Reputation feature of Cisco Secure Email Gateway in October 2026, tracked as advisory cisco-sa-esa-afw-zqYJkjxp. An unauthenticated attacker can send a crafted email attachment to write arbitrary files and run commands as root; the supplied text includes no CVE or CVSS score. Appliances are affected when File Reputation is enabled on a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. The fix is Content Scanner Tools 25.3.0.5525 or later, with no workaround; Secure Email and Web Manager and Secure Web Appliance are not vulnerable.

GBHackersOct 15, 15:12 UTC · 1d agoExploit / PoC in the wild 12 sources1· 1 read

Cisco warns of actively exploited Secure Email Gateway flaw

Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to run root commands via crafted attachments.

Cisco confirmed active exploitation of CVE-2026-76519 in physical and virtual Secure Email Gateway appliances running vulnerable AsyncOS. When File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, a specially crafted email attachment can write arbitrary files and execute commands as root. Fixed releases are AsyncOS 15.5.5-014 and 16.5.0-780; customers on 16.0 should migrate, and Content Scanner Tools 25.3.0.5525 can be updated without a restart. Cisco said attackers could obtain cluster SSH keys and hide evidence, and it has already updated Secure Email Cloud Gateway. No victim count or attacker identity was disclosed.

CSO Onlineupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 12:32 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to write files and run commands as root.

Cisco confirmed attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in the Advanced Malware Protection file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root when File Reputation is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Updating the scanner does not require a product restart; AsyncOS fixes are 15.5.5-014 and 16.5.0-780, while 16.0 has no fix. Cisco-managed Secure Email Cloud is already protected. Cisco says this is the third exploited email-gateway root flaw since December 2025 and warns attackers may hide evidence, so external firewall and network logs should be checked.

Security Affairsupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 09:27 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco says attackers are exploiting critical unauthenticated CVE-2026-76519 in Secure Email Gateway for root access.

Cisco warned that CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway Advanced Malware Protection is under active exploitation. Unauthenticated attackers can send crafted attachments, when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, to write arbitrary files and run commands as root. Fixes released September 14 in versions 15.5.5-014 and 16.5.0-780 were originally grouped under CVE-2026-76440. CISA added the flaw to KEV with an October 17 federal deadline; it follows exploited CVE-2026-76461.

SecurityWeekupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 06:34 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519 CVE-2026-76440 CVE-2026-76461

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

Actively exploited CVE-2026-76519 lets unauthenticated attackers gain root on Cisco Secure Email Gateway.

CERT-EU republished Cisco’s advisory for CVE-2026-76519, a CVSS 9.8 relative path traversal in the AMP file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root. Cisco PSIRT says exploitation is active, and compromised cluster SSH keys could expose other members. Affected AsyncOS lines are 15.5 before 15.5.5-014, all 16.0, and 16.5 before 16.5.0-780 when Content Scanner Tools is older than 25.3.0.5525.

CERT-EU Advisoriesupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 00:00 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-765192· 1 read

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Cisco says attackers are exploiting critical Secure Email Gateway flaw CVE-2026-76519 to write files and gain root.

Cisco said attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway. An unauthenticated sender can email a crafted attachment, write files to the appliance operating system, and potentially run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped in AsyncOS 15.5.5-014 and 16.5.0-780, or Content Scanner Tools 25.3.0.5525 and later; release 16.0 has no fixed build. Cisco contacted managed Secure Email Cloud customers showing possible compromise indicators. Separately, September's SQL-injection flaw CVE-2026-76461 was exploited and added to CISA's KEV catalog.

The Hacker Newsupdated Oct 15, 15:12 UTC · 1d agofirst Oct 14, 18:38 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-76519 CVE-2026-76461

Content Scanner Tools

Timeline6 articles

Related CVEsby mentions

Appears with