Cisco Warns of Actively Exploited Secure Email Gateway Flaw That Allows Root Command Execution

A critical vulnerability in Cisco's Secure Email Gateway is being exploited in the wild, and the company urges customers to apply fixes.

In an advisory issued Wednesday, Cisco confirmed exploitation of CVE-2026-76519, which affects the product's Advanced Malware Protection feature and stems from improper handling of email attachments when the File Reputation service is enabled. A specially crafted attachment can let an attacker write arbitrary files and execute commands with root privileges. Cisco says no workarounds address the flaw.

Who is affected

Physical and virtual appliances running vulnerable AsyncOS software are affected if the File Reputation service is enabled and assigned to a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases, and advises customers on AsyncOS 16.0 to migrate to a fixed release.

Cisco warns that an attacker who compromises an appliance could access private SSH keys used between cluster members and could remove evidence of their activity. It recommends checking system logs for indicators of compromise, while noting that a clean result should not replace a broader investigation of network and firewall logs.