✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Microsoft Fixes 1,413 Vulnerabilities Across Windows and Enterprise Products

October 14, 2026
Rewterz

Threat Actors Deploy PEERSTITCH Malware Against Fortinet Firewalls – Active IOCs

October 16, 2026

Cisco Secure Email Gateway Critical Flaw Under Active Exploitation

Severity

High

Analysis Summary

Cisco has warned of active exploitation of a critical-severity vulnerability, tracked as CVE-2026-76519 (CVSS 9.8), affecting its Secure Email Gateway appliance. The flaw resides in the Advanced Malware Protection (AMP) feature and could allow remote, unauthenticated attackers to write arbitrary files to the underlying operating system and execute commands with root privileges.

According to Cisco, the vulnerability is triggered when processing email attachments under specific conditions: the file reputation service must be enabled, and the appliance must be running a Content Scanner Tools version earlier than 25.3.0.5525. Attackers can exploit the flaw by sending emails containing specially crafted attachments, potentially gaining complete control over affected systems.

Cisco confirmed that its Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. However, attackers with elevated privileges may delete or conceal evidence of their activities, complicating incident detection and investigation.

Organizations are advised to review network and firewall logs outside affected appliances for suspicious activity, including unexpected uploads or downloads involving external IP addresses. Customers who suspect exploitation on physical appliances should contact Cisco Technical Assistance Center (TAC). For virtual appliances, Cisco recommends deploying a new virtual machine with a fixed software release, rebuilding the configuration from scratch, rotating credentials, and preserving forensic evidence.

Cisco has also contacted customers using its Secure Email Cloud service where potential compromise indicators were identified and deployed mitigations within its managed environment.

Remediation: Cisco released fixes for CVE-2026-76519 on September 14, 2026, in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780. The vulnerability was initially grouped with other security issues under CVE-2026-76440. Cisco subsequently updated its September advisory to disclose active exploitation.

This is the second Secure Email Gateway vulnerability exploited in the wild since mid-September, following CVE-2026-76461, another unauthenticated vulnerability that could enable remote command execution with root privileges. Organizations should prioritize patching affected appliances and investigate potential compromise.

Impact

  • Remote Code Execution
  • Unauthorized Access
  • Sensitive Information Exposure

Indicators of Compromise

CVE

  • CVE-2026-76519

Remediation

  • Upgrade Cisco Secure Email Gateway to a fixed software release, version 15.5.5-014 or 16.5.0-780, or later applicable patched versions.
  • Analyze network and firewall logs for suspicious uploads, downloads, and connections to unfamiliar external IP addresses.
  • Contact Cisco Technical Assistance Center (TAC) if exploitation is suspected on a physical appliance.
  • For compromised virtual appliances, deploy a new virtual machine with a fixed software release and rebuild the configuration from scratch.
  • Rotate credentials associated with potentially compromised systems to prevent continued unauthorized access.
  • Preserve forensic evidence before performing recovery actions to support incident investigation.
  • Investigate affected appliances for suspicious files, unauthorized changes, and signs of concealed attacker activity.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo