Cisco has disclosed another critical vulnerability in its Secure Email Gateway that attackers were already exploiting before a fix existed. The flaw, tracked as CVE-2026-76519 and rated 9.8 out of 10, sits in the Advanced Malware Protection feature’s handling of email attachments. A remote attacker with no credentials can send a malicious email and, on a successful exploit, write files and run commands with root privileges on the appliance operating system.
The exposure is conditional but common in enterprise deployments. Both physical and virtual gateways are affected when the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco said it became aware of active exploitation in October, that a limited number of customers were affected, and that there is no workaround: upgrading to a fixed AsyncOS release is the only remedy, with customers on releases earlier than version 16.5 advised to migrate to 16.5.0-780.
The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on October 14 and set a Saturday deadline for federal agencies to remediate it, an unusually short fuse that reflects the root level of access involved.
This is the second exploited zero day in the same product in as many months. A similar malicious email to root flaw was exploited in mid-September, and attackers exploited another critical AsyncOS flaw in January to install persistence mechanisms. For defenders, the pattern matters as much as this single patch: internet facing mail appliances from one vendor have now produced three exploited critical flaws in ten months, which argues for treating the gateway tier as a priority patching and compromise assessment surface, not routine infrastructure.