Cisco says attackers exploit Secure Email Gateway flaw

Cisco says attackers are actively exploiting a critical vulnerability in its Secure Email Gateway that could let an unauthenticated sender write files to the appliance’s operating system and potentially run commands with root privileges. The company has not reported how many devices were targeted or confirmed that attackers gained root access. The flaw, identified as CVE-2026-76519 and rated 9.8 on the Common Vulnerability Scoring System, involves the handling of email attachments. An attacker would send a specially crafted attachment through an affected gateway. Cisco says the attack succeeds only when two conditions are met: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than version 25.3.0.5525. Gateways that do not meet both conditions are not vulnerable to this attack path. Cisco advises administrators to check the scanner version and install Content Scanner Tools 25.3.0.5525 or later. The update can be installed without a software upgrade or restart. Administrators with automatic updates enabled should verify that the new version has been applied; those with automatic updates disabled can install it manually.