Cisco has released fixes for CVE-2026-76519, a critical flaw in its Secure Email Gateway that attackers have already exploited. Cisco published its security advisory on 14 October 2026 and rates the flaw 9.8 out of 10 on the CVSS severity scale. It says “there are no workarounds.”
Cisco Secure Email Gateway is an appliance that filters incoming email for businesses, blocking spam and malware.
What the flaw does
According to Cisco, the flaw is in the gateway’s Advanced Malware Protection (AMP) feature and “could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.” It is caused by “improper handling of email attachments when the file reputation service is enabled.”
An attacker only needs to send an email with a specially crafted attachment through the gateway. Cisco says a successful attack “could allow the attacker to write arbitrary files and execute commands with root privileges”, giving the attacker full control of the device.
“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” Cisco said, referring to its security response team.
Who is affected
Cisco says a gateway is vulnerable only if both of these are true:
- The File Reputation service, part of AMP, is turned on and assigned to a mail policy.
- The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco says its Secure Email and Web Manager and Secure Web Appliance are not affected. Customers of its cloud email service, Secure Email Cloud, do not need to act; Cisco says it has already deployed the fix there and contacted customers where it found signs of malicious activity.
BleepingComputer reported that the internet watchdog Shadowserver tracks nearly 300 Cisco Secure Email Gateway instances exposed online. That is not a count of victims, and Cisco has not said how many customers were attacked.
How to fix it
Cisco lists these fixed AsyncOS software releases:
- Release 15.5: 15.5.5-014
- Release 16.0: move to a fixed release
- Release 16.5: 16.5.0-780
The fix is also delivered through Content Scanner Tools version 25.3.0.5525 or later, which does not need a full software upgrade or restart. Customers with automatic updates turned on need take no action once the update has been applied.
Not the same as September’s flaw
This is a separate bug from CVE-2026-76461, another actively exploited Secure Email Gateway zero-day that Cisco warned about in September. BleepingComputer reported that the earlier flaw was in the gateway’s email parsing; the new one is in its malware protection feature.
What this means
- Patch now. Attackers are already using this flaw, and there is no workaround.
- Check two settings. Gateways with File Reputation on and old Content Scanner Tools are at risk.
- A second hit in two months. Cisco’s email gateway has had two exploited zero-days since September.
Sources
- Cisco Security Advisory, “cisco-sa-esa-afw-zqYJkjxp” (CVE-2026-76519), first published 14 October 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
- BleepingComputer, “Cisco patches new Secure Email Gateway zero-day exploited in attacks”, Sergiu Gatlan, 14 October 2026. https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/
