OP 15 October, 2026 - 08:26 PM
As Cisco said in its warning published on Wednesday, attackers are exploiting a critical vulnerability in the Cisco Secure Email Gateway that allows the sender to write files to the device's operating system without authorization.
The attacker sends an email through the gateway with a specially crafted attachment and, if successful, can run commands with root privileges. The device filters the organization's email for spam, malware, and other threats; Only gateways that have the File Reputation service enabled and Content Scanner Tools version prior to 25.3.0.5525 are vulnerable.
The patch has been shipping since September 14 in AsyncOS versions 15.5.5-014 and 16.5.0-780, builds that Cisco listed that day as a security hotfix in the security hardening release and which the company claims to fix the vulnerability. The fix also comes as an update to Content Scanner Tools version 25.3.0.5525 or later, which is installed without a software update or restart.
Cisco discovered this vulnerability, registered as CVE-2026-76519 (CVSS score: 9.8), during its own internal security scans and became aware of the attacks in October. The notification does not specify how many devices were attacked, who is behind them, or whether the attackers have obtained root rights on any of them.
Cisco has contacted customers of its Secure Email Cloud managed service whose devices have shown "signs of possible compromise" and says it is currently in the process of remediating the vulnerability and recovering it. Administrators of these managed gateways may not have the command line access required to perform the hacking check below, and Cisco has already deployed a patched scanner there, so they don't need to take any action to install the patch.
Who is at risk
Both conditions must be met. File Reputation, part of Advanced Anti-Malware (AMP) and responsible for handling attachments, must be enabled and bound to email policy, and the Content Scanner Tools version must be lower than 25.3.0.5525.
The vulnerability affects physical and virtual gateways running on vulnerable versions of AsyncOS. Secure Email, Web Manager, and Secure Web Appliance are not affected by this vulnerability.
To check the first condition, open Mail Policies > Incoming Mail Policies > Advanced Malware Protection or a similar section under Outgoing Email Policies, select the mail policy, and note the Enable File Reputation Checks checkbox. To check the second condition, run the contentscannerstatus command at a command prompt to display the version and date of the last update.
How to fix the problem
The fastest way is to update the scanner. For gateways with Content Scanner Tools automatic updates enabled, no action is required after the update is applied, so use the contentscannerstatus command to verify that the version is 25.3.0.5525 or later, rather than just assumingthat the update has been installed.
If automatic updates are disabled, run the contentscannerupdate command at a command prompt or enable them in Security Services > Service Updates.
The full fix for AsyncOS is contained in the following first patched releases:
There is no workaround. For a virtual appliance that shows signs of being compromised, Cisco recommends reinstalling with the new credentials and warns that updating the compromised instance will result in the destruction of forensic data and logs.
How to Check for Hacking
Cisco Checking for Abuse Attempts is a single command on the device: grep "System Security" system_logs. It returns one of three messages:contentscannerstatus
If the device is
compromised In the case of a physical device, Cisco asks customers to contact the TAC and enable remote access so that the company's engineers can investigate. For a virtual appliance, you need to complete the following steps:
The September release
This is the second Secure Email Gateway vulnerability that Cisco has confirmed as being attacked in the past month. On September 14, the company disclosed the CVE-2026-76461 vulnerability, an "SQL injection" vulnerability in the gateway's email parsing mechanism that could allow an unauthorized sender to run commands with root privileges using a specially crafted email.
This vulnerability affects all configurations and was added to the CISA "Known Exploited Vulnerabilities" directory on the same day. Both vulnerabilities are in different parts of the software and have different log checks, and Cisco has not established a link between these attacks.
On the same day, Cisco released an update to improve the security of the gateway, Secure Email, and Web Manager solutions, grouping internally discovered vulnerabilities into five general CVEs by vulnerability class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, each with a score of 9.8 and CVE-2026-76442 with a score of 7.5. Each of these scores is the highest among the vulnerabilities in this class, and the recommendation listed builds 15.5.5-014 and 16.5.0-780.
On Wednesday, Cisco updated this notice to read: "Two of them are known to be actively exploited": a write-to-file vulnerability in the "path traversal" class and an SQL injection vulnerability discovered in September in the "improper neutralization" class. There is no information about attacks related to other vulnerabilities in this release.
In accordance with Cisco's disclosure policy established in June, vulnerabilities patched in security hardening releases share a common CVE, and a vulnerability has its own CVE, including when it is known to be exploited. The file writing vulnerability was patched in September as part of the "walk-through" group and received its own warning on Wednesday.
It is also the third root vulnerability in these devices that Cisco has confirmed to be exploited since December, when a China-linked group tracked by Cisco Talos under the index UAT-9686 exploited a zero-day vulnerability in the spam quarantine feature (CVE-2025-20393), which Cisco patched in January.
source : https://thehackernews.com/2026/10/cisco-...tacks.html
![[Image: Pn2slWO.jpeg]](https://i.imgur.com/Pn2slWO.jpeg)
LIFETIME
The attacker sends an email through the gateway with a specially crafted attachment and, if successful, can run commands with root privileges. The device filters the organization's email for spam, malware, and other threats; Only gateways that have the File Reputation service enabled and Content Scanner Tools version prior to 25.3.0.5525 are vulnerable.
The patch has been shipping since September 14 in AsyncOS versions 15.5.5-014 and 16.5.0-780, builds that Cisco listed that day as a security hotfix in the security hardening release and which the company claims to fix the vulnerability. The fix also comes as an update to Content Scanner Tools version 25.3.0.5525 or later, which is installed without a software update or restart.
Cisco discovered this vulnerability, registered as CVE-2026-76519 (CVSS score: 9.8), during its own internal security scans and became aware of the attacks in October. The notification does not specify how many devices were attacked, who is behind them, or whether the attackers have obtained root rights on any of them.
Cisco has contacted customers of its Secure Email Cloud managed service whose devices have shown "signs of possible compromise" and says it is currently in the process of remediating the vulnerability and recovering it. Administrators of these managed gateways may not have the command line access required to perform the hacking check below, and Cisco has already deployed a patched scanner there, so they don't need to take any action to install the patch.
Who is at risk
Both conditions must be met. File Reputation, part of Advanced Anti-Malware (AMP) and responsible for handling attachments, must be enabled and bound to email policy, and the Content Scanner Tools version must be lower than 25.3.0.5525.
The vulnerability affects physical and virtual gateways running on vulnerable versions of AsyncOS. Secure Email, Web Manager, and Secure Web Appliance are not affected by this vulnerability.
To check the first condition, open Mail Policies > Incoming Mail Policies > Advanced Malware Protection or a similar section under Outgoing Email Policies, select the mail policy, and note the Enable File Reputation Checks checkbox. To check the second condition, run the contentscannerstatus command at a command prompt to display the version and date of the last update.
How to fix the problem
The fastest way is to update the scanner. For gateways with Content Scanner Tools automatic updates enabled, no action is required after the update is applied, so use the contentscannerstatus command to verify that the version is 25.3.0.5525 or later, rather than just assumingthat the update has been installed.
If automatic updates are disabled, run the contentscannerupdate command at a command prompt or enable them in Security Services > Service Updates.
The full fix for AsyncOS is contained in the following first patched releases:
- 15.5: 15.5.5-014
- 16.0: Fix build missing. Upgrade to the fixed release.
- 16.5: 16.5.0-780
- Content Scanner Tools (all licensed and supported AsyncOS releases): 25.3.0.5525 or later
There is no workaround. For a virtual appliance that shows signs of being compromised, Cisco recommends reinstalling with the new credentials and warns that updating the compromised instance will result in the destruction of forensic data and logs.
How to Check for Hacking
Cisco Checking for Abuse Attempts is a single command on the device: grep "System Security" system_logs. It returns one of three messages:contentscannerstatus
- System security: A sign of possible hacking has been detected. Contact the Technical Support Center (TAC) for further guidance. A hack has been detected. Follow the recovery steps below.
- System security: The security check is not complete. Contact the Technical Support Center (TAC) for further guidance. Contact the Cisco Technical Support Center (TAC).
- System security: No signs of hacking were detected. During this check, no hacking was detected. Update your system if the device is running on an affected version.
If the device is
compromised In the case of a physical device, Cisco asks customers to contact the TAC and enable remote access so that the company's engineers can investigate. For a virtual appliance, you need to complete the following steps:
- First of all, save the data for forensic examination. Updating a compromised instance destroys its logs and evidence.
- Deploy the new VM on the patched version.
- Restore the configuration without importing any previous configuration files.
- Update the credentials and cryptographic materials on the device and then proceed to monitor for unusual behavior.
The September release
This is the second Secure Email Gateway vulnerability that Cisco has confirmed as being attacked in the past month. On September 14, the company disclosed the CVE-2026-76461 vulnerability, an "SQL injection" vulnerability in the gateway's email parsing mechanism that could allow an unauthorized sender to run commands with root privileges using a specially crafted email.
This vulnerability affects all configurations and was added to the CISA "Known Exploited Vulnerabilities" directory on the same day. Both vulnerabilities are in different parts of the software and have different log checks, and Cisco has not established a link between these attacks.
On the same day, Cisco released an update to improve the security of the gateway, Secure Email, and Web Manager solutions, grouping internally discovered vulnerabilities into five general CVEs by vulnerability class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, each with a score of 9.8 and CVE-2026-76442 with a score of 7.5. Each of these scores is the highest among the vulnerabilities in this class, and the recommendation listed builds 15.5.5-014 and 16.5.0-780.
On Wednesday, Cisco updated this notice to read: "Two of them are known to be actively exploited": a write-to-file vulnerability in the "path traversal" class and an SQL injection vulnerability discovered in September in the "improper neutralization" class. There is no information about attacks related to other vulnerabilities in this release.
In accordance with Cisco's disclosure policy established in June, vulnerabilities patched in security hardening releases share a common CVE, and a vulnerability has its own CVE, including when it is known to be exploited. The file writing vulnerability was patched in September as part of the "walk-through" group and received its own warning on Wednesday.
It is also the third root vulnerability in these devices that Cisco has confirmed to be exploited since December, when a China-linked group tracked by Cisco Talos under the index UAT-9686 exploited a zero-day vulnerability in the spam quarantine feature (CVE-2025-20393), which Cisco patched in January.
source : https://thehackernews.com/2026/10/cisco-...tacks.html
LIFETIME