Cisco warns of actively exploited Secure Email Gateway flaw

A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers to
write arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply available fixes after confirming that the flaw is being exploited in the wild.

The flaw affects the product’s Advanced Malware Protection (AMP) feature and stems from improper handling of email attachments when the File Reputation service is enabled. By sending an email containing a specially crafted attachment through a vulnerable appliance, an attacker can execute commands with root privileges.

Cisco released software updates to address the flaw, but warns that there are no workarounds that address the vulnerability.

Exploitation is subject to preconditions

Tracked as CVE-2026-76519, the vulnerability affects physical and virtual Cisco Secure Email Gateway appliances running vulnerable Cisco AsyncOS software, provided two conditions are met. The File Reputation service needs to be enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.

The File Reputation service is part of Cisco AMP, which helps assess the reputation of files passing through the email gateway. In this case, improper handling of attachments creates an opportunity for an attacker to write arbitrary files to the underlying operating system. Successful exploitation can then lead to root-level command execution, potentially enabling further compromise of the appliance.

Cisco warns that attackers who compromise an appliance could access private SSH keys used to authenticate between members of an appliance cluster, potentially allowing them to compromise other cluster members. Attackers with root access may also remove or conceal evidence of their activity.

Cisco recommends checking the appliance’s system logs for indicators of compromise using the command grep “System Security” system_logs. However, a clean result should not replace broader investigation: the vendor advises administrators to cross-check external network and firewall logs for suspicious traffic, including unexpected uploads from affected appliances or downloads from malicious IP addresses.

Patches are available, but incident response matters

Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases for the corresponding software branches. Customers on AsyncOS 16.0 are advised to migrate to a fixed release. The vendor also said the fix is available through Content Scanner Tools version 25.3.0.5525 and later, and that updating the tools does not require a software upgrade or appliance restart.

For potentially compromised virtual appliances, Cisco recommends preserving forensic evidence before rebuilding the system, deploying a clean virtual machine, rebuilding its configuration without importing previous configuration files, and renewing credentials and cryptographic materials.

Organizations should also assess other appliances in the same cluster. The company said it has already deployed the fixed Content Scanner Tools package for its Secure Email Cloud Gateway environment. The advisory does not disclose the number of victims or identify the attackers behind the exploitation.