Affected Systems

Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS versions prior to 15.5.5-014 or 16.5.0-780, with File Reputation service enabled and Content Scanner Tools package older than version 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected.

Exploitation Status

Active exploitation confirmed by Cisco in October 2026. Cisco discovered the flaw during internal security scanning and has contacted customers of managed Secure Email Cloud service showing indicators of compromise. Number of affected devices and attacker identity unknown.

Business Impact

Unauthenticated remote attackers can write arbitrary files to the appliance OS by sending crafted email attachments through the gateway, leading to root-level command execution. This bypasses all authentication and allows complete system compromise of email security infrastructure. Organizations using affected gateways face risk of email interception, data exfiltration, and pivot attacks into internal networks. This is the second actively exploited Secure Email Gateway vulnerability in one month (following CVE-2026-76461 SQL injection in September).

Urgency

🔴 Immediate

Recommended Actions

  • Immediately run 'contentscannerstatus' at CLI to verify Content Scanner Tools version is 25.3.0.5525 or later; if not, run 'contentscannerupdate' or enable automatic updates under Security Services > Service Updates
  • Execute 'grep "System Security" system_logs' on every cluster member to check for compromise indicators; contact Cisco TAC if compromise detected or scan fails to complete
  • Upgrade AsyncOS to fixed releases: 15.5.5-014 (for 15.5 branch) or 16.5.0-780 (for 16.x branch); AsyncOS 16.0 has no fixed build and must migrate to 16.5.0-780
  • Review firewall and network logs for unexpected outbound connections from gateway appliances to external IPs, as attackers with root access can erase on-device evidence
  • For compromised virtual appliances: preserve forensic data, deploy new VM on fixed release, rebuild configuration from scratch with new credentials and cryptographic material, and restore all cluster members if any one member was compromised