Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Cisco has confirmed active exploitation of a critical vulnerability, CVE-2026-76519, in its Secure Email Gateway appliances. The flaw allows an unauthenticated attacker to write files to the operating system and potentially execute commands as root by sending a maliciously crafted email attachment. The vulnerability affects systems with the File Reputation service enabled and running a vulnerable version of the Content Scanner Tools package (prior to 25.3.0.5525). Cisco has released fixes via both AsyncOS updates and a standalone Content Scanner Tools update, and advises immediate remediation due to active attacks.

AI-extracted · verify before operational use