Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Summary: Cisco disclosed active exploitation of CVE-2026-76519, a CVSS 9.8 file-write flaw in Secure Email Gateway that lets an unauthenticated sender write files to the appliance's operating system and potentially run commands as root by sending an email with a crafted attachment. The flaw affects gateways with File Reputation enabled and Content Scanner Tools older than 25.3.0.5525, was found in Cisco's internal scanning, fixed in AsyncOS 15.5.5-014 and 16.5.0-780 shipped September 14, and Cisco learned of the attacks in October.
What you should know: This is the second Secure Email Gateway flaw Cisco has confirmed under attack in a month, following CVE-2026-76461, and the third root-level flaw in these appliances exploited since December, when a China-linked group Cisco Talos tracks as UAT-9686 used a spam quarantine zero-day. Cisco has contacted managed Secure Email Cloud customers whose devices showed indicators of possible compromise, and for virtual appliances it recommends a rebuild with new credentials because upgrading a compromised instance destroys the forensic data and logs.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-76519
- Related
- CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability Known Exploited Vulnerabilities · Oct 14, 2026