Cisco Secure Email Gateway flaw CVE-2026-76519 exploited for root access
Attackers are exploiting CVE-2026-76519 (CVSS 9.8) in Cisco Secure Email Gateway, where a malicious email attachment grants unauthenticated root-level command execution. The fix is Content Scanner Tools 25.3.0.5525 or AsyncOS 16.5.0-780; CISA added the flaw to its KEV catalog with an October 17 deadline.
- CVE-2026-76519 scores 9.8 and needs no login for root command execution
- Triggered by AMP File Reputation with Content Scanner Tools below 25.3.0.5525
- CISA added it to KEV; federal agencies must patch by October 17
- Fix needs no reboot; 16.0 branch gets no patch and must migrate to 16.5
Read next
Security