Cisco Warns of Exploited Secure Email Gateway Vulnerability

Key Points:

• Cisco has reported active exploitation of a critical vulnerability (CVE-2026-76519) in its Secure Email Gateway, allowing remote, unauthenticated attackers to write arbitrary files and execute commands with root privileges.
• The vulnerability affects the Advanced Malware Protection feature when the file reputation service is enabled and specific versions of Content Scanner Tools are installed. Organizations using affected versions are at high risk.
• Immediate actions include migrating to patched AsyncOS software releases (versions 15.5.5-014 and 16.5.0-780), monitoring network logs for suspicious activity, and contacting Cisco TAC for suspected exploits.

Technical Details: CVE-2026-76519 has a CVSS score of 9.8/10 and allows attackers to exploit email attachments to gain elevated access on the operating system.

MITRE ATT&CK Techniques:

• T1203 - Exploit Public-Facing Application (Initial Access)
• T1068 - Exploitation of Vulnerability (Privilege Escalation)

IOCs Mentioned:

• CVE-2026-76519
• CVE-2026-76461