Attackers are exploiting a crucial flaw in Cisco Safe E mail Gateway that lets a sender with no login write information to the equipment’s working system, Cisco mentioned in an advisory on Wednesday.
The attacker sends an electronic mail with a crafted attachment by means of the gateway and, if it succeeds, might then run instructions as root. The equipment filters a company’s electronic mail for spam, malware, and different threats, and solely a gateway with the File Status service enabled and a Content material Scanner Instruments package deal older than model 25.3.0.5525 is susceptible.
The repair has been transport since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as mounted in a hardening launch that day, which the corporate now says coated this flaw. It additionally arrives as a Content material Scanner Instruments replace, model 25.3.0.5525 or later, which installs with no software program improve or a restart.
Cisco discovered the flaw, tracked as CVE-2026-76519 (CVSS rating: 9.8), in its personal inner safety scanning and have become conscious of the assaults in October. The advisory doesn’t say what number of gadgets have been attacked, who’s behind the assaults, or whether or not the attackers obtained root on any of them.
Cisco has contacted clients of its managed Safe E mail Cloud service whose gadgets confirmed “indicators of attainable compromise” and says it’s engaged in remediation and restoration. Directors of these managed gateways might not have the command-line entry wanted to run the compromise test beneath, and Cisco has already deployed the mounted scanner there, so that they want no motion to get the repair.
Who Is Uncovered
Each circumstances should maintain. The File Status service, a part of the Superior Malware Safety (AMP) characteristic that handles attachments, should be enabled and assigned to a mail coverage, and the Content material Scanner Instruments model should be sooner than 25.3.0.5525.
Bodily and digital gateways on susceptible AsyncOS releases are affected. Safe E mail and Net Supervisor and Safe Net Equipment are usually not.
To test the primary situation, open Mail Insurance policies > Incoming Mail Insurance policies > Superior Malware Safety, or the identical path below Outgoing Mail Insurance policies, select a mail coverage, and take a look at the Allow File Status field. To test the second, run contentscannerstatus on the CLI, which reveals the model and when it was final up to date.
Tips on how to Repair It
The quickest route is the scanner replace. Gateways with computerized Content material Scanner Instruments updates turned on want no motion as soon as the replace has utilized, so affirm with contentscannerstatus that the model is 25.3.0.5525 or later somewhat than assuming it arrived.
The place computerized updates are off, run contentscannerupdate on the CLI, or flip them on below Safety Providers > Service Updates.
The total AsyncOS repair is in these first mounted releases:
- 15.5: 15.5.5-014
- 16.0: no mounted construct. Migrate to a hard and fast launch.
- 16.5: 16.5.0-780
- Content material Scanner Instruments (all licensed and supported AsyncOS releases): 25.3.0.5525 or later
Cisco recommends that any gateway sooner than 16.5 transfer to 16.5.0-780. A 16.0 gateway on 16.0.4-302, the construct that mounted September’s SQL injection flaw, is just not mounted for this one, and the advisory doesn’t listing which releases rely as licensed and supported for the scanner replace. For a 16.0 gateway that stays on 16.0, the scanner model proven by contentscannerstatus is the one affirmation the advisory provides.
There isn’t any workaround. For a digital equipment that reveals indicators of compromise, Cisco’s steerage is a rebuild with new credentials, and it warns that upgrading a compromised occasion destroys the forensic knowledge and logs.
Tips on how to Verify for Compromise
Cisco’s test for tried exploitation is one command on the equipment: grep “System Safety” system_logs. It returns considered one of three messages:
System Safety: Suspected compromise indicator was discovered. Contact TAC for additional suggestions.Compromise detected. Observe the restoration steps beneath.System Safety: Safety scan didn't full. Contact TAC for additional suggestions.Contact Cisco’s Technical Help Heart (TAC).System Safety: No compromise indicator was discovered.No compromise detected by this test. Improve if the machine is on an affected launch.
Run it on each member of a cluster. A clear outcome is just not proof: an attacker with root might take away or conceal proof, so additionally test firewall and community logs outdoors the machine for surprising uploads to exterior IP addresses or downloads from malicious ones. The advisory doesn’t say what the scan seems for.
If a System Is Compromised
For a bodily equipment, Cisco asks clients to contact TAC and to allow distant entry so its engineers can examine. For a digital equipment, its steps are:
- Protect forensic knowledge first. Upgrading a compromised occasion destroys its logs and proof.
- Deploy a brand new digital machine on a hard and fast launch.
- Rebuild the configuration with out importing any earlier configuration file.
- Renew the credentials and cryptographic materials on the equipment, then hold monitoring for uncommon habits.
Cluster members authenticate to one another with SSH key pairs. A compromised member’s personal keys might give the attacker a approach into the others, so Cisco recommends restoring each member of a cluster that comprises at the least one compromised equipment. Safe E mail Cloud clients it has contacted are requested to resume credentials and cryptographic materials the place attainable.
The September Launch
That is the second Safe E mail Gateway flaw Cisco has confirmed below assault in a month. On September 14 it disclosed CVE-2026-76461, a SQL injection flaw within the gateway’s electronic mail parsing that would let an unauthenticated sender run instructions as root by means of a crafted electronic mail.
That flaw impacts each configuration and was added to CISA’s Identified Exploited Vulnerabilities catalog the identical day. The 2 flaws sit in numerous elements of the software program and have completely different log checks, and Cisco has not linked the assaults.
The identical day, Cisco revealed a hardening launch for the gateway and for Safe E mail and Net Supervisor that grouped internally discovered bugs into 5 umbrella CVEs by weak spot class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, every scored 9.8, and CVE-2026-76442 at 7.5. Every rating is the best among the many bugs in that class, and the advisory carried the 15.5.5-014 and 16.5.0-780 builds.
Cisco up to date that advisory on Wednesday, and it now says “Two of them are recognized to be actively exploited”: the file-write flaw, which sits within the path traversal class, and the September SQL injection flaw, which sits within the improper neutralization class. It isn’t conscious of assaults on the opposite bugs within the launch.
Below a disclosure coverage Cisco set out in June, bugs mounted in hardening releases share grouped CVEs, and a flaw will get its personal CVE when, amongst different causes, it’s recognized to be exploited. The file-write flaw was mounted in September inside the trail traversal group and acquired its personal advisory on Wednesday.
It’s also the third root-level flaw in these home equipment that Cisco has confirmed exploited since December, when a China-linked group that Cisco Talos tracks as UAT-9686 used a zero-day within the spam quarantine characteristic, CVE-2025-20393, that Cisco patched in January.
