https://reddit.com/r/cybersecurity/comments/1x6ra8d/cisco_confirmed_attacks_on_secure_email_gateway/: Cisco confirmed attacks on Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) on October 14, but the fix shipped on September 14 under an umbrella CVE for "path traversal"

Q: Which deployments are affected?

A Secure Email Gateway is exposed when File Reputation is enabled for a mail policy and Cisco Content Scanner Tools is older than version 25.3.0.5525. Nearly 300 such gateways were observed exposed online by Shadowserver.

Q: What does an attacker need to exploit this issue?

The described attack requires sending a single email with a crafted attachment. Successful exploitation can write files to the gateway and execute commands as root.

Q: What should teams do if their gateway meets the exposure conditions?

Update Content Scanner Tools to at least 25.3.0.5525 and ensure the relevant AsyncOS hardening updates are applied. Cisco shipped fixes in AsyncOS 15.5.5-014 and 16.5.0-780 on September 14.

Q: How can an organization know whether it may already have been compromised?

Cisco identified indicators of possible compromise on some devices in its managed Secure Email Cloud service and contacted affected customers. The provided information does not identify specific indicators for self-assessment.

Published Oct 15, 2026

Updated

Affected Software

1 affected component

Cisco Content Scanner Tools<25.3.0.5525

Frequently Asked Questions

Which deployments are affected?

A Secure Email Gateway is exposed when File Reputation is enabled for a mail policy and Cisco Content Scanner Tools is older than version 25.3.0.5525. Nearly 300 such gateways were observed exposed online by Shadowserver.

What does an attacker need to exploit this issue?

The described attack requires sending a single email with a crafted attachment. Successful exploitation can write files to the gateway and execute commands as root.

What should teams do if their gateway meets the exposure conditions?

Update Content Scanner Tools to at least 25.3.0.5525 and ensure the relevant AsyncOS hardening updates are applied. Cisco shipped fixes in AsyncOS 15.5.5-014 and 16.5.0-780 on September 14.

How can an organization know whether it may already have been compromised?

Cisco identified indicators of possible compromise on some devices in its managed Secure Email Cloud service and contacted affected customers. The provided information does not identify specific indicators for self-assessment.

https://reddit.com/r/cybersecurity/comments/1x6ra8d/cisco_confirmed_attacks_on_secure_email_gateway/: Cisco confirmed attacks on Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) on October 14, but the fix shipped on September 14 under an umbrella CVE for "path traversal"

Affected Software

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What should teams do if their gateway meets the exposure conditions?

How can an organization know whether it may already have been compromised?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What should teams do if their gateway meets the exposure conditions?

How can an organization know whether it may already have been compromised?