If your organization runs Cisco Secure Email Gateway as its email security layer, stop what you’re doing and check your Content Scanner Tools version. On October 14, CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog after Cisco confirmed attackers are actively exploiting it right now. A single crafted email — one attachment — is enough for an unauthenticated attacker to take over the appliance with root privileges.

What the vulnerability is

CVE-2026-76519 is a critical arbitrary file write flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway (the email security appliance formerly known as IronPort). Cisco rates it CVSS 9.8/10. The flaw exists in the appliance’s handling of email attachments specifically when the File Reputation service is enabled — which is the default setup for most mail policies.

The root cause is improper handling of attachments during malware analysis. Because the parser doesn’t validate input properly, an attacker who sends an email with a crafted attachment can write arbitrary files onto the underlying operating system. From there it’s a short hop to executing arbitrary commands as root. No account, no credentials, no user interaction required. If the gateway sits in your DMZ scanning inbound mail — and that’s its whole job — it is reachable by anyone who knows your MX record.

Actively exploited, now under KEV deadline

This isn’t theoretical. Cisco PSIRT confirmed in October 2026 it became aware of active exploitation of CVE-2026-76519, and linked it to a broader set of vulnerabilities it originally bundled under internal tracking CVE-2026-76440 in its September security-hardening release. It’s the second Cisco Secure Email Gateway zero-day exploited in the wild since mid-September — the earlier unauthenticated root-RCE flaw hit affected appliances too.

Concerned? You should be. Two critical SMTP-gateway bugs, both under attack, weeks apart. A compromised mail gateway is a prized beachhead: it sees every inbound and outbound message, holds quarantine data, and often sits one hop from AD authentication and internal mailboxes.

CISA added CVE-2026-76519 to KEV on October 14 and gave federal civilian agencies until October 17, 2026 to remediate. For everyone else, the message is the same: fix this now.

What’s affected

The vulnerability affects Cisco Secure Email Gateway, both physical and virtual (VM-Series), regardless of device configuration — but only if two conditions are met: the File Reputation service (part of AMP) is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.

Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected.

How to fix it

The good news: the fix is simple and, for most environments, requires no appliance restart or full software upgrade. The vulnerability is fixed in Content Scanner Tools versions 25.3.0.5525 and later. Update the Content Scanner Tools package — you can do it manually from Security Services > Service Updates, or just enable automatic updates and let it land on its own. If auto-updates are already on, you may have nothing to do beyond confirming the update applied.

Cisco is also shipping fixed AsyncOS releases: 16.5.0-780 and 15.5.5-014. If you’re on release 16.0 or any branch earlier than 16.5, Cisco recommends migrating to 16.5.0-780.

If you think you’ve been hit

Because a successful exploit grants root, attackers can and do remove or hide their tracks. Cisco recommends cross-checking network and firewall logs outside the appliance for signs you wouldn’t see in the device’s own logs — look for unexpected uploads from the appliance to external IPs, or downloads from known-malicious addresses. For virtual appliances, Cisco’s guidance is blunt: deploy a fresh VM on a fixed release, rebuild the configuration from scratch without importing old config files, and rotate credentials.

One extra concern worth flagging: on a compromised cluster, attackers can grab the private SSH keys used for inter-cluster communication and pivot to other members. If any appliance in a cluster is suspected compromised, Cisco says to restore every member to a secure state.

Action items

• Log into your Secure Email Gateway and check the Content Scanner Tools version. If it’s below 25.3.0.5525, update it — or turn on automatic updates.
• Upgrade to a fixed AsyncOS release (16.5.0-780 preferred) if you’re on affected software.
• Review external firewall and network logs for unexpected traffic from your mail gateways.
• If you run virtual appliances in a cluster, treat a suspected compromise as a rebuild-and-rotate event, not a patch-and-move-on.

Two exploited Cisco mail-gateway zero-days in a month is a clear pattern. Your edge email appliance is a target — treat it like one.