Cisco Patches Actively Exploited CVSS 9.8 Email Gateway Flaw

Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that could allow remote, unauthenticated attackers to write arbitrary files to the underlying operating system and execute commands with root privileges. Tracked as CVE-2026-76519, the flaw carries a CVSS score of 9.8 out of 10.

The vulnerability affects the Advanced Malware Protection (AMP) feature and results from improper handling of email attachments when the File Reputation service is enabled. Cisco released security updates and warned that no workaround addresses the flaw, making patch verification a priority for organisations running affected appliances.

The company became aware of exploitation in October 2026. It has not publicly disclosed the number of affected systems or identified the attackers responsible.

Which Systems Are Vulnerable?

The flaw affects physical and virtual Cisco Secure Email Gateway appliances running vulnerable Cisco AsyncOS software. Exploitation requires two conditions: the File Reputation service must be enabled and assigned to a mail policy, and the Content Scanner Tools package must be older than version 25.3.0.5525.

The vulnerability can be triggered when an attacker sends an email containing a specially crafted attachment through an affected gateway. Successful exploitation could provide root-level command execution, potentially giving attackers extensive control over the appliance.

A compromised gateway could also expose private SSH keys used for authentication between clustered appliances. This creates a risk that an intrusion could extend beyond the initially affected system. Attackers with root access may also be able to remove or conceal evidence of their activity.

Security Updates Are Available

Cisco has released fixes for affected software branches. Administrators should verify their current configuration and apply the appropriate update.

The fixed releases include:

• AsyncOS 15.5: Version 15.5.5-014

• AsyncOS 16.5: Version 16.5.0-780

• Content Scanner Tools: Version 25.3.0.5525 or later

Organisations running AsyncOS 16.0 should migrate to a fixed release. Updating Content Scanner Tools to version 25.3.0.5525 or later can address the vulnerability without requiring an AsyncOS upgrade or appliance restart. Administrators should confirm that the updated package has actually been applied rather than assuming automatic updates have completed.

Administrators Should Check for Compromise

Installing the fix is only one part of the response. Organisations should inspect system logs for indicators of compromise and review network and firewall records for suspicious connections, unexpected uploads or downloads involving affected appliances.

Cisco recommends investigating potential compromise rather than relying solely on a clean automated check. If an appliance may have been breached, security teams should follow the vendor's recovery guidance, preserve forensic evidence where appropriate and assess other systems in the same cluster.

The incident highlights the importance of patch verification and monitoring for email security infrastructure. Because these gateways process external messages and help protect internal networks, a compromise could undermine a critical layer of organisational defence.

With active exploitation confirmed and no workaround available, organisations using affected configurations should prioritise remediation and investigate suspicious activity before returning potentially compromised systems to normal operation.