Cisco has disclosed an actively exploited vulnerability in Cisco Secure Email Gateway (SEG) that can allow a remote, unauthenticated attacker to execute commands with root privileges.
The company rates CVE-2026-76519 as Critical. The vulnerability has a CVSS v3.1 score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Bleeping Computer reported on October 14, 2026 that Cisco PSIRT became aware of active exploitation in October. Cisco has not attributed the activity to a threat actor or disclosed its scale. The available reporting also does not establish how many systems were successfully compromised.
Which Cisco systems are exposed
The flaw is in the Advanced Malware Protection feature of Cisco Secure Email Gateway and is classified as a relative path traversal issue, CWE-23.
According to the Cisco PSIRT advisory, physical and virtual SEG appliances are vulnerable only when all of the following apply:
- The appliance runs a vulnerable Cisco AsyncOS release.
- File Reputation, part of Cisco AMP, is enabled and assigned to a mail policy.
- Content Scanner Tools is earlier than 25.3.0.5525.
Cisco gives Content Scanner Tools 25.2.0.5427 as an example of a vulnerable version.
Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected by CVE-2026-76519.
Shadowserver was tracking nearly 300 internet-exposed SEG instances, according to Bleeping Computer. That figure is not a count of vulnerable or compromised appliances and may include secured systems or honeypots.
A crafted attachment can cross into the underlying operating system
CVE-2026-76519 results from improper handling of email attachments while File Reputation is active. An attacker can exploit it by sending a specially constructed attachment through an affected gateway.
Successful exploitation permits arbitrary file writes on the underlying operating system. Those writes can then lead to command execution as root, giving an attacker the highest level of control over the appliance.
The attack does not require authentication or user interaction. However, exploitation depends on the affected mail-processing configuration and the vulnerable Content Scanner Tools version.
Administrators can check whether File Reputation is enabled under:
Mail Policies > Incoming Mail Policies > Advanced Malware Protection
or:
Mail Policies > Outgoing Mail Policies > Advanced Malware Protection
After selecting a mail policy, inspect Enable File Reputation.
The installed Content Scanner Tools version can be checked from the command line with:
contentscannerstatus
A fixed installation must report 25.3.0.5525 or later.
Fixed releases and required migrations
Cisco says there are no workarounds. Administrators should install a fixed release or migrate where the current branch has no correction.
| AsyncOS branch | Cisco’s first fixed release or action |
|---|---|
| 15.5 | 15.5.5-014 |
| 16.0 | No fixed release; migrate to a fixed release |
| 16.5 | 16.5.0-780 |
| Earlier than 16.5 | Cisco strongly recommends migration to 16.5.0-780 |
The correction is also delivered through Content Scanner Tools 25.3.0.5525 or later to licensed and supported AsyncOS releases.
The Hacker News reports that Content Scanner Tools can be updated without upgrading or restarting AsyncOS. Automatic service updates may already have installed the corrected package. Where they have not, administrators can run:
contentscannerupdate
Updates can also be enabled through Security Services > Service Updates.
For the 16.0 branch, operators should follow Cisco’s explicit instruction to migrate rather than assuming that a build fixing a different SEG vulnerability also resolves CVE-2026-76519.
How to check for signs of compromise
Cisco instructs administrators to search the appliance system logs with:
grep "System Security" system_logs
Every member must be checked separately in clustered deployments. Cisco maps the possible messages to these actions:
-
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.
Cisco treats this result as a detected compromise and directs the customer to follow its recovery recommendations. -
System Security: Security scan did not complete. Contact TAC for further recommendations.
Contact Cisco TAC for assistance. -
System Security: No compromise indicator was found.
Upgrade to a fixed release where applicable.
A clean local result is not a substitute for reviewing external telemetry. Because root access can allow an intruder to delete or conceal evidence on the gateway, Cisco strongly recommends examining firewall and network logs outside the appliance. Administrators should look for unexpected uploads to external IP addresses and downloads from malicious IP addresses.
Cisco says it directly contacted Secure Email Cloud customers whose devices showed indicators of possible compromise and is working on remediation and recovery. It has also deployed mitigations within its cloud management environment. Administrators of cloud-managed devices may have insufficient CLI access to perform the appliance-side checks independently.
Compromised appliances require rebuilding, not just patching
For a physical appliance showing signs of compromise, Cisco directs customers to contact TAC and enable remote access to support the investigation.
For virtual appliances, Cisco recommends the following sequence:
- Preserve forensic data under the organization’s incident-handling policy. Upgrading a compromised instance destroys logs and other forensic information.
- Deploy a new virtual machine running a fixed release.
- Rebuild its configuration without importing configuration files from the compromised system.
- Replace credentials and cryptographic material installed on the appliance.
- Continue monitoring for anomalous activity.
Clustered deployments require broader action. Members authenticate to one another using SSH key pairs, so private keys recovered from one compromised appliance could expose other members. Cisco therefore strongly recommends restoring every member of a cluster if at least one member is compromised.
Systems without suspected exploitation should be upgraded to a fixed release or receive Content Scanner Tools 25.3.0.5525 or later as soon as operationally possible.
