-
Attackers are exploiting high severity flaws in Cisco Secure Email Gateway. All it takes is one email with a malicious attachment for them to gain full control over the device.
-
No workaround exists. Admins must update Content Scanner Tools to version 25.3.0.5525 or later, then check for signs of a break-in.
-
This is the second exploited gateway flaw in a month. US federal agencies have been mandated to install the newly released version with the fix by Saturday.
Cisco has warned about a new vulnerability in its Secure Email Gateway that allows hackers to take over a device. The bug is tracked as CVE-2026-76519. A successful exploit using an infected email attachment gives the attacker high privilege access, without needing a password sign-in.
Cisco published its advisory on Wednesday, October 14. It rates the flaw 9.8 out of 10, which is critical. Experts call this kind of bug a zero-day. That means attackers used it before a fix existed.
What the Vulnerability does and Who’s at Risk
The weak spot sits in Advanced Malware Protection. This feature checks email attachments for threats. Cisco says the gateway mishandles some attachments when its File Reputation service is on.
A crafted file can then fool the system into putting files where it shouldn’t. Once that’s done, the attacker isn’t just inside they can run any command they want, with root-level power. Root is the highest level of control.
Cisco says its own security scans found the flaw. Even so, the company confirmed that attackers used it in real attacks. Its security team learned of the activity in October. Cisco has not named the attackers. It also has not said how many customers suffered attacks.
Both physical and virtual gateways are at risk. However, two conditions must hold. First, File Reputation must be on and assigned to a mail policy. Second, Content Scanner Tools must be older than version 25.3.0.5525.
Two related products are safe. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected.
Many gateways face the internet. The group Shadowserver tracks nearly 300 of them online. It does not say how many are decoys or already fixed. Still, attackers have plenty of targets.
How to Fix It
Cisco offers no workaround, so updating is the only real defense. Fortunately, the fix is small. It comes as an update to Content Scanner Tools. Admins do not need a full software upgrade or a restart.
Customers with automatic updates turned on need to do nothing. Everyone else must run the contentscannerupdate command by hand.
Cisco also lists fixed software releases. Version 15.5 users should move to 15.5.5-014. Version 16.5 users should move to 16.5.0-780. Version 16.0 users must migrate to a fixed release.
Cloud customers have less to do. Cisco says it already installed the fix for Secure Email Cloud Gateway. It also contacted cloud customers where it saw signs of a break-in.
How Users can Check for a Break-in
Patching does not undo a past attack. Fortunately, Cisco gives admins a simple check. They can search the system logs for the phrase “System Security.” The log then shows one of three messages. One says the scan found no sign of compromise. Another says the scan did not finish. The last says it found a suspected compromise.
Be careful with a clean result, though. An attacker with root access can erase evidence. For that reason, Cisco tells teams to review firewall and network logs outside the device. They should look for odd uploads to outside addresses. They should also look for downloads from suspicious ones.
If a break-in is likely, the steps differ. Owners of physical devices should contact Cisco’s support center. Owners of virtual devices should first save forensic data, because an upgrade destroys it. Next, they should build a new virtual machine on a fixed release. Then they should renew all passwords and security keys.
Clusters need extra care. Gateways in a cluster use SSH keys to trust each other. A thief could use those keys to reach other members. So Cisco says to restore every device in a cluster if even one falls.
Cisco has Witnessed This Problem Before
This is not the first scare. On September 14, Cisco disclosed CVE-2026-76461, another gateway flaw already under attack. That bug also scored 9.8 and also gave attackers root access. However, it came from a different weakness. Attackers could sneak database commands into an email.
Earlier, attackers also exploited CVE-2025-20393, starting in November 2025. Cisco patched it in January. Together, that makes three exploited zero-days in about a year. The timing matters. A mail gateway sits in the path of every message a company receives. When it falls, attackers gain a strong position inside the network.
Cisco firewall vulnerabilities have also drawn attention after attackers reportedly exploited a flaw for weeks before a patch became available. Amazon detailed that activity in a ransomware group exploited a Cisco firewall flaw for weeks before a patch became available.
Federal Agencies Receive Deadline to Apply the Patch
The US Cybersecurity and Infrastructure Security Agency added the flaw to its list of known exploited bugs. Federal civilian agencies must fix it by Saturday, October 17.
Private companies do not have to follow that date. Still, it is a useful guide. Start with a count. Find every Cisco Secure Email Gateway in your company. Then check File Reputation and the Content Scanner Tools version on each one. If you’re using anything below 25.3.0.5525, update it right away, and afterward, search the logs and review network traffic for any unusual activity.
