On October 14, 2026, Cisco warned that attackers are already exploiting the critical vulnerability CVE-2026-76519 (CVSS 9.8) in Cisco Secure Email Gateway. To attack a device, they need neither a password nor network access. It is enough to send the organization an email with a specially crafted attachment. As a result, Cisco email gateways, which handle all incoming mail of an organization, are at risk.

What we know about the vulnerability

  1. How the attack works. The gateway scans attachments in incoming emails. A malicious attachment lets the attacker write files to the device operating system and then run commands as root, that is, with full control.
  2. Which devices are at risk. Physical and virtual Cisco Secure Email Gateway appliances on AsyncOS, if two conditions are met at the same time:
    • the File Reputation feature is enabled and tied to a mail policy;
    • the Content Scanner Tools package is older than 25.3.0.5525.
  3. Attacks are already happening. Cisco found the flaw during its own security review and then saw it exploited in October. The company does not say how many devices were affected.
  4. There are no workarounds. Only an update protects you.
  5. Not affected: Cisco Secure Email and Web Manager, Secure Web Appliance and the Secure Email Cloud gateways that Cisco manages.

How to protect Cisco email gateways

  • Update Content Scanner Tools to version 25.3.0.5525 or later. The package updates without a gateway reboot. You can also turn on automatic service updates.
  • Update AsyncOS:
    • branch 15.5 to version 15.5.5-014;
    • branch 16.5 to version 16.5.0-780;
    • branch 16.0 has no fixed build, so you need to move to a fixed release. Build 16.0.4-302 does not close this flaw.

If the gateway may already be hacked

Cisco advises checking the system logs on every device in the cluster for signs of compromise. A clean result does not guarantee safety yet, so it is also worth reviewing network equipment logs for suspicious connections.

Important: the update erases logs on a compromised device, so save the data for the investigation first. Also, Cisco recommends redeploying virtual gateways on a fixed version without importing the old configuration and replacing all credentials and keys. If even one device in a cluster is compromised, you need to rebuild all of them.

Why it matters

An email gateway is the first line of email defense, because every incoming message passes through it. A captured gateway lets an attacker read and alter mail, send phishing on behalf of the company and move deeper into the network.

This is already the second actively exploited flaw in these gateways within a month. In September, Cisco closed the SQL injection CVE-2026-76461, which attackers also used.

Read also: Cisco releases a critical firewall update; Microsoft releases an out-of-band Exchange Server update; CISA adds five old vulnerabilities to the KEV catalog.

How S-byte can help protect your email

S-byte is a Cisco partner with experience in state TPI expertise of Cisco equipment.

  • Urgent gateway check. We check AsyncOS and Content Scanner Tools versions, File Reputation settings and signs of compromise.
  • Safe update. We save logs for the investigation, update or migrate the gateway to a fixed version and redeploy it if needed.
  • Technical support with SLA. We follow Cisco advisories and install critical updates on time.
  • Information security audit. We assess the security of your mail infrastructure and network perimeter as a whole.
  • IT consulting and cybersecurity. We select and deploy solutions to protect email and workstations.

Do you use Cisco Secure Email Gateway? Do not wait for the next malicious attachment. Contact S-byte, and we will check and update your email gateways.