Cisco Secure Email Gateway vulnerability: CVE-2026-76519 #
Cisco disclosed that certain versions of Cisco AsyncOS Software for Cisco Secure Email Gateway are affected by an arbitrary file write vulnerability within the Advanced Malware Protection (AMP) feature. The flaw stems from improper handling of email attachments on systems where the File Reputation service is enabled, assigned to a mail policy, and running Content Scanner Tools earlier than version 25.3.0.5525. An unauthenticated, remote attacker can exploit this by sending a specially crafted email attachment through an affected device, allowing them to write arbitrary files to the underlying operating system and execute commands with root privileges. The vulnerability has been designated CVE-2026-76519 and has been rated critical with a CVSS score of 9.8.
Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026.
The following versions are affected
- Cisco Secure Email Gateway 15.5: Versions prior to 15.5.5-014
- Cisco Secure Email Gateway 16.0: All versions
- Cisco Secure Email Gateway 16.5: Versions prior to 16.5.0-780
Cisco recommends that customers running releases earlier than 16.5 migrate to 16.5.0-780.
What is Cisco Secure Email Gateway? #
Cisco Secure Email Gateway is an email security appliance, available as a physical, virtual, or cloud gateway, that protects organizations from spam, phishing, and malware. Its Advanced Malware Protection (AMP) feature uses a file reputation service to evaluate email attachments.
What is the impact? #
Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to achieve full, root-level compromise of the underlying operating system on affected devices.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Cisco Secure Email Gateway 15.5: Upgrade to 15.5.5-014 or later.
- Cisco Secure Email Gateway 16.0: Migrate to a fixed release.
- Cisco Secure Email Gateway 16.5: Upgrade to 16.5.0-780 or later.
- Cisco Secure Email Gateway releases earlier than 16.5: Migrate to 16.5.0-780.
Note: The fix is also distributed to all licensed and supported AsyncOS releases through Content Scanner Tools version 25.3.0.5525 or later, which can be applied without a software upgrade or restart. Use the contentscannerupdate CLI command or enable automatic updates under Security Services > Service Updates. Cisco Secure Email Cloud Gateway customers do not need to take action.
Find exposed Cisco Secure Email Gateway's with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:=http AND protocol:=http AND last.html.title:"Cisco%Gateway%C" AND NOT last.html.title:"Cloud"September 2026: CVE-2026-76461 #
Cisco has reported a vulnerability in their Secure Email Gateway product. This flaw allows remote, unauthenticated attackers to execute arbitrary code on the vulnerable system. Successful exploitation could allow complete system compromise.
This vulnerability has been assigned CVE-2026-76461 and is rated highly critical has a CVSS score of 9.8.
Note that there is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected
- 15.5.4-012 and earlier
- 16.0.3-044 and earlier
- 16.5.0 before 16.5.0-780
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- 15.5.5-014 and later
- 16.0.4-302 and later
- 16.5.0-780 and later
Find exposed Cisco Secure Email Gateway's with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:=http AND protocol:=http AND last.html.title:"Cisco%Gateway%C" AND NOT last.html.title:"Cloud"December 2025 advisory: #
Cisco reported a vulnerability in their Secure Email Gateway product. This flaw allowed remote, unauthenticated attackers to execute arbitrary code on the vulnerable system. Successful exploitation could have allowed complete system compromise.
This vulnerability was assigned CVE-2025-20393, was rated highly critical, and had a CVSS score of 10.0.
Note that there was evidence that this vulnerability was being actively exploited in the wild.
All versions of Cisco Secure Email Gateway except Cisco Secure Email Gateway Cloud were affected.
What was the impact? #
Successful exploitation of these vulnerabilities would have allowed an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Were updates or workarounds available? #
There was no patched fixed version of this product available at the time. The vendor recommended disabling the "Spam Quarantine" feature and isolating potentially vulnerable systems behind network access controls.
How runZero users found potentially vulnerable systems #
From the Service inventory, users ran the following query to locate potentially vulnerable assets:
_asset.protocol:=http AND protocol:=http AND last.html.title:"Cisco%Gateway%C" AND NOT last.html.title:"Cloud"
