Cybersecurity
Cisco warns of attacks on Secure Email Gateway flaw
Cisco said attackers were exploiting a Secure Email Gateway vulnerability that could let an unauthenticated sender write to the appliance and, if successful, run commands as root.
- Cisco said attackers were exploiting CVE-2026-76519 in Secure Email Gateway, a flaw that let an unauthenticated sender write files to the appliance operating system.
- Cisco said only gateways with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 were vulnerable.
- Cisco said the fix had been available since 14 September in AsyncOS 15.5.5-014 and 16.5.0-780, and also as Content Scanner Tools 25.3.0.5525 or later.
- Cisco said it learned of the attacks in October and did not say how many devices were hit or who carried them out.
- Cisco contacted managed Secure Email Cloud customers whose devices showed signs of possible compromise.
Cisco said attackers were using a flaw in Secure Email Gateway against appliances that filtered email traffic. The issue let a sender without credentials write files to the device, and a successful attack could then lead to root-level command execution.
The vulnerability applied only when File Reputation was enabled for a mail policy and Content Scanner Tools was older than 25.3.0.5525. Cisco said the scanner update could be applied without a software upgrade or restart, and that the fixed AsyncOS builds were 15.5.5-014 and 16.5.0-780.
Cisco said it found the flaw through internal security scanning and became aware of the attacks in October. The advisory did not identify the attackers, give a device count, or say whether root access had been achieved.
Cisco said it had contacted managed Secure Email Cloud customers whose devices showed signs of possible compromise. It also said there was no workaround and that Secure Email and Web Manager and Secure Web Appliance were not affected.
Named in this story
Companies
- Cisco
- issued the advisory and said the flaw was under active attack
Organisations
- Cisco's Technical Assistance Center
- was the support team Cisco told customers to contact
Governments and agencies
- CISA
- kept the September flaw in its Known Exploited Vulnerabilities catalog
Products and systems
- Secure Email Gateway
- was the affected appliance software
- File Reputation
- had to be enabled for the flaw to matter
- Content Scanner Tools
- needed to be older than version 25.3.0.5525 for exposure
- AsyncOS
- had fixed releases 15.5.5-014 and 16.5.0-780
- Cisco Secure Email Cloud
- had customers that Cisco contacted about possible compromise
- Secure Email and Web Manager
- was listed as not affected
- Secure Web Appliance
- was listed as not affected
- Advanced Malware Protection
- contained the File Reputation feature
How the source tells it
The source was a procedural security advisory with a restrained, informational register.
No emotive framing was found in the original.