This is a live exploitation signal, not a routine patch notice. Cisco’s 14 October advisory rates CVE-2026-76519 at CVSS 9.8: a crafted email attachment can trigger an unauthenticated arbitrary file write and root-level command execution on a vulnerable Cisco Secure Email Gateway. Cisco says its security response team became aware of active exploitation in October; CISA added the CVE to its Known Exploited Vulnerabilities catalog on 14 October.
Who should act
Check physical and virtual Secure Email Gateway appliances where AMP File Reputation is enabled for a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected by this vulnerability. Cisco Secure Email Cloud customers need to follow any direct notice from Cisco; its advisory says the fixed scanner package is already deployed in that service.
Priority actions
- Confirm File Reputation under incoming and outgoing mail policies; run
contentscannerstatusto verify the scanner-tools version. - Update to Content Scanner Tools 25.3.0.5525 or later, or install a fixed AsyncOS release (15.5.5-014 or 16.5.0-780). Cisco says the scanner update does not require a restart. There is no workaround.
- Review appliance system logs and external firewall or network-egress logs. If compromise is suspected, preserve evidence before rebuilding or upgrading, contact Cisco TAC, then rotate credentials and keys. Check cluster peers because appliance SSH keys may be exposed.
Sources: Cisco PSIRT advisory · CISA KEV catalog entry · Canadian Centre for Cyber Security update.