Recent reports indicate that a critical vulnerability in Cisco Secure Email Gateway is being exploited by attackers. This flaw allows a sender without login credentials to write files to the appliance’s operating system, potentially leading to the execution of commands with root privileges. Cisco issued an advisory on Wednesday, acknowledging the existence of this vulnerability.
The attack involves sending an email with a specially crafted attachment through the gateway. Successful exploitation of the vulnerability could enable the attacker to run commands as root. It is important to note that only gateways with the File Reputation service enabled and running a Content Scanner Tools package older than version 25.3.0.5525 are susceptible to this exploit.
A fix for this vulnerability has been available since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780. Cisco has identified the flaw as CVE-2026-76519 and assigned it a CVSS score of 9.8. The company discovered the vulnerability through internal security scanning and became aware of attacks targeting it in October.
Cisco has taken proactive measures to address the issue, including contacting customers of its managed Secure Email Cloud service who may have been affected. The company is currently involved in remediation and recovery efforts for compromised devices.
Key Points:
- The vulnerability affects gateways with the File Reputation service enabled and running Content Scanner Tools version older than 25.3.0.5525.
- Gateways on vulnerable AsyncOS releases are impacted, while Secure Email and Web Manager and Secure Web Appliance remain unaffected.
- To check for vulnerability, administrators can verify the File Reputation service status and Content Scanner Tools version.
Resolution Steps:
The recommended solution is to update the Content Scanner Tools to version 25.3.0.5525 or later. Gateways with automatic updates enabled will receive the fix automatically. For gateways with manual updates, administrators can run contentscannerupdate at the CLI or enable automatic updates under Security Services.
Cisco advises gateways earlier than 16.5 to upgrade to version 16.5.0-780. Gateways on version 16.0.4-302 are not protected and should consider migrating to a fixed release. There is no workaround for this vulnerability.
Compromise Check:
Administrators can run a command on the appliance to check for signs of compromise. It is crucial to monitor network logs for any suspicious activities, as a clean result from the check does not guarantee immunity from attacks.
Compromised Devices:
In case of a compromised device, Cisco recommends preserving forensic data, deploying a new virtual machine on a secure release, rebuilding the configuration, and renewing credentials and cryptographic material. Secure Email Cloud customers are advised to renew credentials and cryptographic material for all cluster members.
This recent vulnerability adds to the list of security issues affecting Cisco Secure Email Gateway. It is imperative for organizations to stay vigilant and apply necessary patches to safeguard their systems from potential threats.
