Cisco Warns of Lively Assaults Exploiting New Important Safe E mail Gateway Vulnerability

Attackers are exploiting a crucial flaw in Cisco Safe E mail Gateway that lets a sender with no login write information to the equipment’s working system, Cisco stated in an advisory on Wednesday.

The attacker sends an e-mail with a crafted attachment by the gateway and, if it succeeds, may then run instructions as root. The equipment filters a corporation’s e-mail for spam, malware, and different threats, and solely a gateway with the File Fame service enabled and a Content material Scanner Instruments bundle older than model 25.3.0.5525 is susceptible.

The repair has been delivery since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as fastened in a hardening launch that day, which the corporate now says lined this flaw. It additionally arrives as a Content material Scanner Instruments replace, model 25.3.0.5525 or later, which installs and not using a software program improve or a restart.

Cisco discovered the flaw, tracked as CVE-2026-76519 (CVSS rating: 9.8), in its personal inner safety scanning and have become conscious of the assaults in October. The advisory doesn’t say what number of units had been attacked, who’s behind the assaults, or whether or not the attackers obtained root on any of them.

Cisco has contacted clients of its managed Safe E mail Cloud service whose units confirmed “indicators of potential compromise” and says it’s engaged in remediation and restoration. Directors of these managed gateways could not have the command-line entry wanted to run the compromise examine under, and Cisco has already deployed the fastened scanner there, so that they want no motion to get the repair.

Who Is Uncovered

Each circumstances should maintain. The File Fame service, a part of the Superior Malware Safety (AMP) function that handles attachments, should be enabled and assigned to a mail coverage, and the Content material Scanner Instruments model should be sooner than 25.3.0.5525.

Bodily and digital gateways on susceptible AsyncOS releases are affected. Safe E mail and Internet Supervisor and Safe Internet Equipment are usually not.

To examine the primary situation, open Mail Insurance policies > Incoming Mail Insurance policies > Superior Malware Safety, or the identical path below Outgoing Mail Insurance policies, select a mail coverage, and have a look at the Allow File Fame field. To examine the second, run contentscannerstatus on the CLI, which reveals the model and when it was final up to date.

Cisco recommends that any gateway sooner than 16.5 transfer to 16.5.0-780. A 16.0 gateway on 16.0.4-302, the construct that fastened September’s SQL injection flaw, will not be fastened for this one, and the advisory doesn’t record which releases rely as licensed and supported for the scanner replace. For a 16.0 gateway that stays on 16.0, the scanner model proven by contentscannerstatus is the one affirmation the advisory affords.

There isn’t any workaround. For a digital equipment that reveals indicators of compromise, Cisco’s steering is a rebuild with new credentials, and it warns that upgrading a compromised occasion destroys the forensic information and logs.

The way to Test for Compromise

Cisco’s examine for tried exploitation is one command on the equipment: grep “System Safety” system_logs. It returns one in every of three messages:

• System Safety: Suspected compromise indicator was discovered. Contact TAC for additional suggestions. Compromise detected. Observe the restoration steps under.
• System Safety: Safety scan didn't full. Contact TAC for additional suggestions. Contact Cisco’s Technical Help Middle (TAC).
• System Safety: No compromise indicator was discovered. No compromise detected by this examine. Improve if the system is on an affected launch.

Run it on each member of a cluster. A clear end result will not be proof: an attacker with root may take away or conceal proof, so additionally examine firewall and community logs exterior the system for surprising uploads to exterior IP addresses or downloads from malicious ones. The advisory doesn’t say what the scan seems to be for.

If a System Is Compromised

For a bodily equipment, Cisco asks clients to contact TAC and to allow distant entry so its engineers can examine. For a digital equipment, its steps are:

1. Protect forensic information first. Upgrading a compromised occasion destroys its logs and proof.
2. Deploy a brand new digital machine on a hard and fast launch.
3. Rebuild the configuration with out importing any earlier configuration file.
4. Renew the credentials and cryptographic materials on the equipment, then preserve monitoring for uncommon conduct.

Cluster members authenticate to one another with SSH key pairs. A compromised member’s personal keys may give the attacker a means into the others, so Cisco recommends restoring each member of a cluster that incorporates at the very least one compromised equipment. Safe E mail Cloud clients it has contacted are requested to resume credentials and cryptographic materials the place potential.

The September Launch

That is the second Safe E mail Gateway flaw Cisco has confirmed below assault in a month. On September 14 it disclosed CVE-2026-76461, a SQL injection flaw within the gateway’s e-mail parsing that might let an unauthenticated sender run instructions as root by a crafted e-mail.

That flaw impacts each configuration and was added to CISA’s Recognized Exploited Vulnerabilities catalog the identical day. The 2 flaws sit in several elements of the software program and have totally different log checks, and Cisco has not linked the assaults.

The identical day, Cisco revealed a hardening launch for the gateway and for Safe E mail and Internet Supervisor that grouped internally discovered bugs into 5 umbrella CVEs by weak spot class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, every scored 9.8, and CVE-2026-76442 at 7.5. Every rating is the best among the many bugs in that class, and the advisory carried the 15.5.5-014 and 16.5.0-780 builds.

Cisco up to date that advisory on Wednesday, and it now says “Two of them are recognized to be actively exploited”: the file-write flaw, which sits within the path traversal class, and the September SQL injection flaw, which sits within the improper neutralization class. It’s not conscious of assaults on the opposite bugs within the launch.

Below a disclosure coverage Cisco set out in June, bugs fastened in hardening releases share grouped CVEs, and a flaw will get its personal CVE when, amongst different causes, it’s recognized to be exploited. The file-write flaw was fastened in September inside the trail traversal group and obtained its personal advisory on Wednesday.

Additionally it is the third root-level flaw in these home equipment that Cisco has confirmed exploited since December, when a China-linked group that Cisco Talos tracks as UAT-9686 used a zero-day within the spam quarantine function, CVE-2025-20393, that Cisco patched in January.