Cisco has warned of active exploitation of a Secure Email Gateway vulnerability that can allow unauthenticated remote attackers to write arbitrary files and execute commands with root privileges. SecurityWeek reported the warning and identified the issue as CVE-2026-76519.
Cisco’s security advisory describes improper handling of crafted email attachments in the Advanced Malware Protection feature. The affected configuration involves the file-reputation service and vulnerable Content Scanner Tools; administrators should use Cisco’s product and version checks rather than infer exposure solely from the product name.
The advisory says Content Scanner Tools version 25.3.0.5525 and later contain the fix. It also states that updating that package does not require a software upgrade or product restart. Customers with automatic updates enabled need no further action once the update has actually been applied; customers without them should follow Cisco’s manual-update instructions.
Cisco separately recommends that customers running AsyncOS releases earlier than 16.5 migrate to 16.5.0-780. Its documented fixed-release information should guide version selection, rather than treating every software release as equivalent.
Patch status and suspected compromise are different questions. Cisco warns that an attacker with root access may remove local evidence, and recommends cross-checking external network and firewall logs. For suspected compromise of a physical appliance, it advises contacting its Technical Assistance Center. Its advisory provides separate recovery guidance for virtual and cloud deployments.
The official guidance adds an important operational distinction to the exploitation warning: verify whether the Content Scanner Tools fix has been applied, and use the relevant incident-recovery guidance if compromise is suspected.