Cisco email gateway: CVE-2026-76519 is already in use
On 14 October Cisco fixed arbitrary file write in Secure Email Gateway, scored 9.8. It requires file reputation to be on and a Content Scanner older than 25.3.0.5525. CISA added the bug the same day.
CVE-2026-76519 lives in Advanced Malware Protection on Cisco Secure Email Gateway, physical and virtual. A message with a crafted attachment, when file reputation is enabled, can write files on the gateway and run commands as root. No login is required. Score 9.8. PSIRT confirmed exploitation, and CISA added the id on 14 October. Secure Email and Web Manager is not affected by this advisory.
When the gateway is in scope at all
Both conditions are required. File Reputation is enabled and assigned to a mail policy. Content Scanner Tools is older than 25.3.0.5525. If reputation is off, this bug does not open you. The fix also arrives as a scanner package: 25.3.0.5525 and later already contain it for supported licenses. In parallel, AsyncOS: 15.5.5-014, the 16.0 line has no point fix and needs a move to a fixed branch, and 16.5 starts at 16.5.0-780. Cisco recommends moving to 16.5.0-780 if you are older than that.
After a successful exploit, root can wipe traces on the gateway itself. That is why Cisco asks you not to trust only its log. The line "System Security: Suspected compromise indicator was found" is a reason to call TAC and to read firewall logs outside the box: unexpected uploads from the gateway's address. An empty log on the device proves nothing with this bug.
Related Lexora services
Company mail goes through a Cisco ESA
We can check the scanner version and whether reputation is on. Without those two facts the advisory is either yours or someone else's.