Critical Zero-Day in Cisco Secure Email Gateway Under Active Exploitation (CVE-2026-76519)

Executive Summary

On October 14th, 2026, Cisco disclosed a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway and confirmed it is under active exploitation. The flaw lets an unauthenticated, remote attacker write arbitrary files and execute commands with root privileges by sending an email with a crafted attachment through the gateway.

Secure Email Gateway filters an organization's inbound and outbound mail, so the attack arrives through normal mail flow. Appliances are affected when the File Reputation service is assigned to a mail policy and the Content Scanner Tools package is older than version 25.3.0.5525. See the Affected Systems or Products section in this advisory for more information.

Cisco learned of the current exploitation and has contacted Secure Email Cloud customers whose devices show signs of compromise. Given root access through routine email, confirmed exploitation, and repeated targeting of these gateways, Beazley Security recommends affected organizations apply available fixes immediately and conduct a review for any signs of compromise.

Affected Systems or Products

Mitigations / Workarounds

iven active exploitation, Beazley Security strongly recommends affected organizations apply patches. Cisco ships the fix both in fixed AsyncOS releases and in Content Scanner Tools 25.3.0.5525 or later. Cisco considers an appliance vulnerable only when File Reputation is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Configurations and versions can be verified by checking the following:

• Run contentscannerstatus at the CLI to see the installed Content Scanner Tools version, and contentscannerupdate to request the fixed package manually.
• Enable automatic updates under Security Services > Service Updates > Edit Update Settings by selecting Automatic Updates, then submitting and committing the changes.
• Check whether File Reputation is in use under Mail Policies > Incoming Mail Policies > Advanced Malware Protection and Mail Policies > Outgoing Mail Policies > Advanced Malware Protection.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

• Cisco does not specifically state that disabling File Reputation is a workaround. However, under Cisco's vulnerable-configuration criteria, an appliance may not be affected when File Reputation is not assigned to any mail policy. Turning it off also removes file reputation scanning of attachments, adversely increasing risks.

Patches

Cisco has released fixed AsyncOS software for Secure Email Gateway and a fixed Content Scanner Tools package, both detailed in the Cisco advisory. Cisco Secure Email Cloud Gateway requires no customer action to receive the fix, because Cisco has already deployed the fixed Content Scanner Tools.

According to Cisco, the Content Scanner Tools fix reaches every licensed and supported AsyncOS release and installs without a software upgrade or restart, so appliances with automatic updates enabled need no further patching action once it applies. Organizations that were exposed should still review for any signs of compromise.

Indicators of Compromise

Cisco confirmed active exploitation of this vulnerability on October 14th, 2026. Cisco has not attributed the activity or stated how many organizations were affected. Cisco reportedly contacted Secure Email Cloud customers whose devices showed signs of malicious activity.

To check an on-premises appliance for exploitation, defenders can review the system security logs with the below command. If the appliance is part of a cluster, run the check on every member:

grep "System Security" system_logs

Cisco documents three possible results from the :

• "System Security: Suspected compromise indicator was found." means a compromise was detected.
• "System Security: Security scan did not complete." means the check did not finish. Contacting Cisco TAC may help to provide more information.
• "System Security: No compromise indicator was found." means no compromise was detected.

An attacker with root access can remove or hide evidence on the appliance, so if exposed, a clean result on the device does not rule out compromise. Defenders can review network and firewall logs outside the appliance for unexpected uploads from the gateway to external IP addresses and for downloads from malicious IP addresses. If compromise is detected, it is recommended that every member of a cluster be investigated and restored accordingly as cluster members authenticate to each other with SSH key pairs, and an attacker could move laterally.

At the time of writing, Cisco has not published any atomic indicators such as file hashes, IP addresses, or domains for this activity.

Technical Details

Cisco has released limited technical details but attributes the vulnerability to improper handling of email attachments in the AMP feature when the File Reputation service is enabled. An attacker sends an email with a crafted attachment through an affected appliance and can then write arbitrary files to the underlying operating system and execute commands as root. Exploitation also requires File Reputation to be assigned to an incoming or outgoing mail policy and Content Scanner Tools to be older than 25.3.0.5525.

This flaw is the latest in a series of exploited vulnerabilities in Cisco's email security appliances. On September 14th, 2026, Cisco disclosed CVE-2026-76461, a SQL injection flaw in the email parsing logic of AsyncOS for Secure Email Gateway. An unauthenticated attacker sends a crafted email containing malicious SQL statements through the gateway, which leads to command execution with root privileges. Beazley Security covered that flaw in a previous advisory.

How Beazley Security is Responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• Cisco: Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
• Cisco: Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX)
• BSL-A1207