Alertas de segurança
Cisco Secure Email Gateway: Critical Vulnerability (CVSS 9.8) Under Active Exploitation
CVE-2026-76519 allows an unauthenticated sender to write files to the appliance and execute commands as root. Cisco confirms active attacks; no workaround exists, only an update resolves the issue.
Cisco has confirmed that attackers are actively exploiting CVE-2026-76519, a critical vulnerability (CVSS 9.8) in Cisco Secure Email Gateway. Users of the product, whether physical or virtual, should check their version today.
What is happening
An unauthenticated sender sends an email with a specially crafted attachment. The vulnerability allows files to be written to the appliance's operating system, enabling command execution as root.
Cisco states that attacks are active and that it became aware of them in October. The advisory does not specify how many devices have been attacked, who is behind them, or whether root access was obtained. However, the fix has been available since September 14.
Who is exposed
The gateway is only vulnerable when both of the following conditions are met:
- the File Reputation service is enabled and assigned to a mail policy;
- the Content Scanner Tools version is earlier than 25.3.0.5525.
Secure Email and Web Manager and Secure Web Appliance are not affected.
What to do now
There is no workaround. The solution is to update:
| AsyncOS version | Fix |
|---|---|
| 15.5 | 15.5.5-014 |
| 16.0 | No fixed build: migrate to a patched version |
| 16.5 | 16.5.0-780 |
If a full update cannot be performed today, update the Content Scanner Tools to version 25.3.0.5525 or later. It can be installed without a system upgrade and without a reboot. Use contentscannerstatus to confirm the version and contentscannerupdate if you need to force the update.
How to tell if a compromise has already occurred
Run grep "System Security" system_logs on the appliance. There are three possible outcomes: an indication of compromise, scan not completed (in this case, contact Cisco TAC), or no indication.
A clean result is not proof that the equipment is secure. Also review firewall and network logs.
If the appliance is virtual and compromised:
- preserve the evidence before updating;
- deploy a new VM already running a patched version;
- reconfigure without importing the old configuration file;
- renew credentials and cryptographic material;
- in a cluster, restore all members.
Context
On September 14, Cisco disclosed CVE-2026-76461, an SQL injection in email parsing that was also exploited and added to CISA's KEV catalog. Cisco confirmed that two vulnerabilities from this set are under attack: the September SQL injection and this file-write flaw. According to The Hacker News coverage, this is the third root-execution vulnerability confirmed as exploited in products of this type since December.
How Indene can help
If you are unsure which version of AsyncOS or Content Scanner Tools is in production, or need support to investigate a possible compromise, please contact our team. [to be confirmed: contact channel and standard CTA]
Sources: Cisco advisory; coverage from The Hacker News.