TL;DR: An unauthenticated attacker can send an email with a crafted attachment that writes files and runs commands as root on Cisco Secure Email Gateway when File Reputation (AMP) is enabled. It's CVSS 9.8 Critical and actively exploited, with no workarounds. (Cisco)
| Item | Detail | Source |
|---|---|---|
| CVE / severity | CVE-2026-76519, Critical, CVSS 3.1 9.8 | Cisco |
| Exploitation | "In October 2026, the Cisco PSIRT became aware of active exploitation" | Cisco |
| KEV | dateAdded 2026-10-14, dueDate 2026-10-17 | KEV |
| Affected | SEG (physical/virtual) with File Reputation enabled on a mail policy and Content Scanner Tools < 25.3.0.5525 | Cisco |
| Fixed | AsyncOS 15.5 → 15.5.5-014; 16.0 → migrate; 16.5 → 16.5.0-780; or Content Scanner Tools ≥ 25.3.0.5525 (no restart needed) | Cisco |
| Not affected | Secure Email and Web Manager, Secure Web Appliance | Cisco |
Press: BleepingComputer reported the exploited zero-day, the affected conditions and the IOCs. (BleepingComputer)
Post-install impact
No confirmed breakage found. Cisco says updating Content Scanner Tools "does not require a software upgrade or a product restart." (Cisco) Note that upgrading a compromised instance destroys forensic data, so collect forensics first. (Cisco)
What to do
- Check
grep "System Security" system_logsfor compromise indicators. If a virtual appliance is compromised, preserve forensics, redeploy, rebuild the config, and rotate credentials. Restore every cluster member. (Cisco)
Last verified 2026-10-15Report an error: [email protected]