Cisco Secure Email Gateway RCE exploited in wild; root access via AMP

Affected Systems

Cisco Secure Email Gateway (physical and virtual) running AsyncOS 15.5 before 15.5.5-014, all 16.0 versions, and 16.5 before 16.5.0-780, with AMP File Reputation service enabled and Content Scanner Tools earlier than 25.3.0.5525. Secure Email Cloud Gateway not affected.

Exploitation Status

Active exploitation confirmed in the wild by Cisco PSIRT. CVE-2026-76519 allows unauthenticated remote attackers to write arbitrary files and execute commands with root privileges via crafted email attachments.

Business Impact

Unauthenticated remote code execution with root privileges on email gateways. Attackers can compromise entire appliance clusters via stolen SSH keys, erase forensic evidence, and pivot to internal networks. Internet-facing email gateways are at immediate risk. CVSS 9.8 critical severity.

Urgency

🔴 Immediate

Recommended Actions

• Immediately update Content Scanner Tools to version 25.3.0.5525 or later, or upgrade AsyncOS to 15.5.5-014, 16.5.0-780, or newer—prioritize internet-facing appliances
• Run 'grep "System Security" system_logs' on all affected devices to check for compromise indicators; trigger incident response if 'Suspected compromise' or 'Security scan did not complete' messages appear
• Review firewall and network logs external to the appliance for unexpected outbound connections, uploads to external IPs, or downloads from malicious sources
• If compromise is detected, isolate affected appliances, rotate SSH keys for cluster members, and contact Cisco TAC for forensic support
• Verify AMP File Reputation service configuration via Mail Policies > Advanced Malware Protection in web UI; consider temporarily disabling if patching is delayed and risk tolerance allows