Back Heise.De

Attackers exploit root vulnerability in Cisco Secure Email Gateway

Heise.De • October 15, 2026

Attackers are currently targeting Cisco Secure Email Gateway instances. Admins should respond immediately and install the available security patches. On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its catalog of actively exploited flaws. The scale of the attacks is currently unknown.

According to a security advisory , the exploited vulnerability (CVE-2026-76519) is rated “ critical. ” The flaw affects the Advanced Malware Protection (AMP) security feature. AMP is designed to scan file attachments for threats.

When unauthenticated remote attackers send emails with a malicious attachment to vulnerable instances, the flaw causes processing errors that let attackers write arbitrary files and run their commands. If an attack succeeds, they end up with root-level system privileges. Attackers in this position typically gain full control of the instances.

According to Cisco, physical and virtual Secure Email Gateway instances are impacted if all the following conditions are met: the File Reputation service must be active and assigned to a mail policy, and a Content Scanner Tools version earlier than 25.3.0.5525 must also be installed. Attacks are possible only when these conditions are met.

The advisory explains how to check the installed Content Scanner Tools version and how admins can identify instances that have already been attacked. To protect systems from attacks, admins must install version 15.5.5-014 or 16.5.0-780 . There is no security update for the 16.0 release line, so admins must install one of the listed versions.

Alternatively, updating Content Scanner Tools to version 25.3.0.5525 or later closes the vulnerability. Cisco says this works with all supported AsyncOS versions without an upgrade or restart. Cisco lists additional security recommendations in the advisory.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Cisco Secure Email Gateway Vulnerability Exploited Cisco has disclosed a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519, which allows unauthenticated remote attackers to execute commands with root privileges. This flaw arises from improper handling of email attachments when the File Reputation service is enabled. Active exploitation of this vulnerability has been confirmed, with attackers able to send crafted emails that compromise the system without user interaction. The vulnerability affects both physical and virtual appliances running vulnerable versions of Cisco AsyncOS, specifically those with Content Scanner Tools versions earlier than 25.3.0.5525. Cisco released patches on October 14, 2026, and has advised affected organizations to apply these updates immediately. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Organizations are urged to review their configurations to determine if they are at risk. 14 sources 78

Extracted Entities

Attackers exploit root vulnerability in Cisco Secure Email Gateway

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)