Cisco is warning customers that attackers are actively exploiting a critical zero-day in Secure Email Gateway appliances. Tracked as CVE-2026-76519, the vulnerability can be triggered by a specially prepared email attachment and may allow an unauthenticated attacker to write arbitrary files and execute commands with root privileges.

The flaw carries a CVSS score of 9.8. Cisco says its security response team learned of exploitation in October 2026, but public information does not identify the attackers or quantify the number of compromised systems. The combination of remote access, no login requirement, and root-level impact makes the issue an urgent operational and incident-response concern.

A malicious attachment can reach the appliance

The weakness is located in the Advanced Malware Protection feature, commonly called AMP. When File Reputation is enabled, affected software does not safely process certain email attachments. An attacker can send a crafted file through the gateway, causing the appliance to write data in an unsafe manner and potentially run commands as root.

The attack path is notable because it does not depend on a recipient opening the attachment or clicking a link. Processing by the gateway itself is the entry point. Root access gives an adversary control over the underlying operating system and may allow evidence to be hidden or deleted.

Both physical and virtual Secure Email Gateway appliances are affected only when two conditions are present: File Reputation is enabled and assigned to a mail policy, and the Content Scanner Tools package is older than 25.3.0.5525. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected by this vulnerability.

Updates are available without a restart

Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as corrected releases. Customers on the 16.0 branch should migrate to a fixed version, and Cisco recommends that installations older than 16.5 move to 16.5.0-780.

Supported, licensed AsyncOS systems can also receive the fix through Content Scanner Tools package 25.3.0.5525 or later. This package update does not require a complete AsyncOS upgrade or an appliance restart. Administrators who disabled automatic updates can request the package with the contentscannerupdate command and should verify the installed version afterward.

There is no workaround. Automatic updating may already have delivered the corrected scanner, but organizations should confirm that result instead of assuming it. Cisco says the fix has been deployed to Secure Email Cloud Gateway, so customers of that hosted service do not need to install it themselves.

Checking for signs of compromise

Administrators can review incoming and outgoing mail policies to determine whether File Reputation is active. The contentscannerstatus command reports the installed Content Scanner Tools version. Cisco also recommends searching system logs for “System Security” events and checking every member of an appliance cluster.

A message indicating suspected compromise should trigger incident response. An incomplete security scan should be escalated to Cisco’s Technical Assistance Center. Importantly, a clean scan cannot conclusively rule out an intrusion because attackers with root control may remove local traces.

Independent telemetry is therefore essential. Network and firewall logs should be reviewed for unexpected uploads from the gateway, downloads from unfamiliar infrastructure, abnormal outbound connections, and administrative activity that does not match normal operations. Evidence should be preserved before rebuilding or making extensive changes.

Patch and investigation must happen together

Security teams should identify every gateway, validate its configuration and scanner package, and update vulnerable systems immediately. They should also assess the period before remediation, because applying the package prevents future use of the known flaw but does not establish whether a system was already accessed.

Email security appliances occupy a trusted position and process untrusted data continuously. That makes this zero-day especially serious: the defensive control becomes the attack surface. Organizations finding suspicious artifacts should involve Cisco TAC and their incident-response team, rotate exposed administrative credentials, and validate the appliance before returning it to normal service.