Cisco has announced that a critical vulnerability in its Secure Email Gateway has been actively exploited by attackers. This flaw, identified as CVE-2026-76519 with a CVSS score of 9.8, allows unauthenticated users to send crafted emails that can execute commands with root privileges on the appliance's operating system. The vulnerability affects those gateways that have the File Reputation service turned on and are using an outdated version of the Content Scanner Tools package, specifically before version 25.3.0.5525.

Cisco discovered the flaw during an internal security scan and has since released a fix available as of September 14. This fix comes in the form of AsyncOS versions 15.5.5-014 and 16.5.0-780, as well as an updated Content Scanner Tools package that does not require a reboot for installation. Cisco has proactively contacted clients using its managed Secure Email Cloud service, whose systems showed signs of possible compromise, to assist in remediation efforts.

Administrators are advised to verify that the File Reputation service is enabled and to ensure their Content Scanner Tools are updated to the latest version. Systems that automatically update will not require further action, but it is crucial to confirm the update with the contentscannerstatus command. In cases where automatic updates are disabled, administrators can manually update using the CLI or enable automatic updates in the Security Services settings.

The vulnerability does not affect Secure Email and Web Manager or Secure Web Appliance systems. Cisco emphasizes the importance of these updates, as exploitation of this flaw, along with another recent SQL injection vulnerability in the same system, could lead to severe compromises. This is the second confirmed exploitation incident involving the Secure Email Gateway this year, highlighting ongoing threats to these critical infrastructures.