Attackers are taking over Cisco email gateways with one booby-trapped attachment. Check your scanner version today

If your company’s mail runs through a Cisco Secure Email Gateway, the gateway itself is the target this week. Cisco said on Wednesday that attackers are exploiting a flaw that lets anyone who can send the box an email write files to it and run commands as root. No login is needed. The attachment does the work.

CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Saturday, October 17, to fix it.

The appliance that scans your attachments for malware can be taken over by an attachment. Cisco says that is already happening.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Cisco confirms attacks on a Secure Email Gateway flaw

Cisco tracks the bug as CVE-2026-76519, a relative path traversal in the Advanced Malware Protection (AMP) feature, rated 9.8. Its advisory, cisco-sa-esa-afw-zqYJkjxp, says an attacker could exploit it “by sending an email that contains a crafted attachment through an affected device,” and that a successful exploit could let the attacker “write arbitrary files and execute commands with root privileges on the underlying operating system.”

Cisco says its PSIRT became aware of active exploitation in October 2026. It has not said who is behind the attacks or how many devices were hit. According to BleepingComputer, Cisco has already deployed mitigations on its cloud-hosted gateways and contacted Secure Email Cloud customers where it found signs of a possible compromise.

This is the second exploited Secure Email Gateway bug in two months. In September Cisco warned about a separate flaw in AsyncOS email parsing that also gave attackers root.

Gateways with File Reputation turned on

A gateway is exposed only when two conditions both hold: the File Reputation service, part of AMP, is enabled and assigned to an incoming or outgoing mail policy, and the Content Scanner Tools package on the box is older than 25.3.0.5525. Physical and virtual appliances are both affected.

The attack needs nothing more than a way to get mail to the gateway, and an email gateway exists to accept mail from strangers. BleepingComputer cites Shadowserver data showing nearly 300 Secure Email Gateway instances exposed online. Cisco also warns that attackers may remove evidence after they get root, so a clean-looking box is not proof of a clean box.

Update Content Scanner Tools, then read the System Security log

• Run contentscannerstatus on each gateway. Anything below 25.3.0.5525 needs the updated Content Scanner Tools package, or an AsyncOS upgrade to 15.5.5-014 or 16.5.0-780. Gateways on 16.0 have to migrate to a fixed release.
• In the web interface, open Mail Policies, then Incoming and Outgoing Mail Policies, then Advanced Malware Protection, and note which policies have Enable File Reputation checked. Those gateways go first.
• Check the system log for “System Security” messages. “Suspected compromise indicator was found” means Cisco treats the device as compromised; follow the advisory’s recommendations and open a TAC case.
• If Cisco contacted you, renew the credentials and certificates installed on the appliance, as Cisco recommends, and limit who can reach its management interface.

Details

• CVE-2026-76519: relative path traversal in AMP file handling, CVSS 9.8, unauthenticated, root command execution. Advisory published October 14, 2026.
• Affected: Cisco Secure Email Gateway, physical and virtual, when File Reputation is enabled on a mail policy and Content Scanner Tools is earlier than 25.3.0.5525.
• Fixed: Content Scanner Tools 25.3.0.5525 or later (delivered to all licensed, supported AsyncOS releases), or AsyncOS 15.5.5-014 and 16.5.0-780. Release 16.0: migrate to a fixed release.
• Exploitation: Cisco PSIRT aware of active exploitation in October 2026. Added to CISA KEV October 14, 2026; federal due date October 17, 2026.

Hunt / verify

• System log lines starting “System Security:” on every gateway. Cisco lists three outcomes: compromise indicator found, scan did not complete, and no indicator found.
• Firewall and network logs for uploads from or downloads to unfamiliar external IP addresses from the gateway, which Cisco asks customers to cross-check.
• Inbound mail since October 1 with unusual attachments that the AMP engine handled shortly before any unexpected gateway activity.

Slack paste: Cisco Secure Email Gateway CVE-2026-76519 exploited (root via crafted attachment). Exposed if File Reputation is on and Content Scanner Tools

Sources

• Cisco: Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
• CVE.org: CVE-2026-76519
• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (October 14, 2026)
• BleepingComputer: Cisco patches new Secure Email Gateway zero-day exploited in attacks

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].