Cisco Warns of Exploited Secure Email Gateway Vulnerability

Post Views: 13

Cisco issued an alert on Wednesday regarding the active exploitation of a critical vulnerability in its Secure Gateway product.

Vulnerability Details

CVE-2026-76519 Overview

The flaw, designated CVE-2026-76519 with a CVSS score of 9.8, affects the Advanced Malware Protection (AMP) feature of the appliance. This defect enables remote, unauthenticated attackers to execute arbitrary file writes on the underlying operating system.

Exploitation and Impact

How the Vulnerability is Exploited

Cisco’s Product Security Incident Response Team (PSIRT) became aware of ongoing exploitation of the vulnerability in October 2026. The vulnerability arises when the file reputation service is enabled and an outdated version of the Content Scanner Tools (earlier than 25.3.0.5525) is installed. Attackers could exploit this by sending emails with malicious attachments, triggering the flaw to write files to the OS and execute commands with root-level privileges.

Cisco’s Response

Patches and Mitigations

Cisco has released indicators of compromise (IoCs) to assist organizations in detecting potential breaches but warned that adversaries may use their elevated access to erase or obscure evidence of intrusion. Security teams are advised to review network and firewall logs beyond affected devices for signs of unauthorized activity, such as unusual data transfers. For physical systems, Cisco recommends contacting its Technical Assistance Center (TAC) if exploitation is suspected. Virtual appliance users have been directly notified by Cisco through its Secure Cloud service, with remediation efforts underway. The company has implemented mitigations through its management systems. Customers are urged to upgrade to a patched AsyncOS release immediately. Patches for CVE-2026-76519 were released on September 14 as part of Secure Gateway versions 15.5.5-014 and 16.5.0-780. At the time, Cisco grouped this flaw with others under CVE-2026-76440. A subsequent update on Wednesday confirmed the vulnerability’s active exploitation in the wild.

Recent Vulnerabilities

This marks the second Cisco Secure Gateway vulnerability exploited in the field since mid-September, following CVE-2026-76461, another unauthenticated flaw enabling root-level command execution.

CISA Involvement

KEV Catalog and Urgency

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply patches by October 17. The advisory highlights the urgency of addressing the flaw due to its high severity and active exploitation.