Cisco Warns Critical Email Gateway Flaw Under Active Attack
The vulnerability allows unauthenticated attackers to gain root-level control of affected appliances through a crafted email attachment.
Topics
News
- Cisco Warns Critical Email Gateway Flaw Under Active Attack
- Bank of America Hires 1,000 Contractors as AI Raises Cyber Costs
- Netflix Cuts About 1,000 Jobs in Biggest Layoff Since 2022
- Indian Embassy in Jakarta Launches AI Avatar Dewi
- Anthropic Tests How Small AI Models Can Replicate Across IoT Devices
- Scientists Call for Global Oversight of Cyber-Capable AI
Cisco has warned that attackers are exploiting a critical vulnerability in Secure Email Gateway that can give them root-level control without login credentials or action by an email recipient.
The flaw, tracked as CVE-2026-76519, has a severity score of 9.8 out of 10 and affects the Advanced Malware Protection feature. Cisco disclosed the vulnerability on October 14 and said its Product Security Incident Response Team became aware of active exploitation this month.
An attacker can exploit the weakness by sending an email with a crafted attachment through a vulnerable gateway. Improper handling of the attachment can allow arbitrary files to be written to the operating system and commands executed with root privileges.
The vulnerability affects physical and virtual Secure Email Gateway appliances running vulnerable AsyncOS versions when File Reputation is enabled and assigned to a mail policy and the Content Scanner Tools package is older than version 25.3.0.5525. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.
Cisco has not identified the attackers behind the exploitation or disclosed how many systems have been compromised. The company said the vulnerability was initially discovered through its own internal security scanning.
The risk does not end once an appliance is patched. Cisco cautioned that an attacker who obtains root privileges could remove or conceal evidence of earlier activity.
It recommended that organizations review logs outside the affected gateway, including firewall and network records, for unexpected uploads or downloads and other suspicious traffic.
There are no workarounds for the vulnerability. Cisco has released fixed AsyncOS versions 15.5.5-014 and 16.5.0-780 and is urging customers on earlier releases to move to a patched version. The fix is also included in Content Scanner Tools version 25.3.0.5525 and later.
Customers using Cisco Secure Email Cloud Gateway do not need to install the update themselves because Cisco said the corrected Content Scanner Tools package has already been deployed in its cloud environment.
