ReconXWatchtower

Where this stands

First reported 14/10/2026

  1. 1Unconfirmed reportnot observed
  2. 2Corroboratednot observed
  3. 3Confirmed14/10/2026CISA Known Exploited Vulnerabilities
  4. 4Exploited now14/10/2026CISA Known Exploited Vulnerabilities

Unconfirmed report and Corroborated were never seen on its own: the first report we had was already stronger.

Cisco Secure Email Gateway (AsyncOS) CVE-2026-76519: actively exploited root code execution via crafted email attachment

Cisco Secure Email Gateway (AsyncOS) · Critical

CVE-2026-76519

Published 26/10/2026 09:38 · Updated 26/10/2026 09:39 (revision 2)

Timeline

4 events over 12 d

  1. 14/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
  2. 14/10/2026ExploitedCISA Known Exploited Vulnerabilities+12 d
  3. 26/10/2026 09:38Published on WatchtowerPro CISO+0 min
  4. 26/10/2026 09:39UpdatedBSI identifies the flaw as CVE-2026-76519 with a critical score of 9.8 out of 10, and…

In short

CVE-2026-76519 (critical, 9.8 out of 10) lets an unauthenticated attacker run commands as root on a Cisco Secure Email Gateway by sending an email with a crafted attachment. Cisco, CISA and national CERTs report active exploitation. Update the Content Scanner Tools package or upgrade AsyncOS now, starting with gateways that receive mail from the internet. GreyNoise reports a public exploit for CVE-2026-76519; listed by CISA as known exploited (26/10/2026).

Affected versions

  • Cisco Secure Email Gateway, physical and virtual, running AsyncOS: 15.5 before 15.5.5-014, all of 16.0, and 16.5 before 16.5.0-780.
  • A gateway is only vulnerable when both conditions are true: File Reputation (part of AMP) is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
  • How to check: in Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection, look at the 'Enable File Reputation' box. Run the CLI command contentscannerstatus to see the CST version.
  • Not affected: Secure Email and Web Manager and Secure Web Appliance. Secure Email Cloud Gateway needs no action because Cisco has already deployed the fixed CST.
  • Sources disagree on older branches. The CVE record, as copied by a tracker, lists builds 13.0.0-392 to 16.0.4-016 as affected, which includes 13.x, 14.x and 15.0. CERT-EU's list starts at 15.5.

Fixed in

  • 15.5 branch: 15.5.5-014
  • 16.5 branch: 16.5.0-780
  • 16.0: no fix

What to do now

  • Update now. Upgrade the Content Scanner Tools (CST) package to 25.3.0.5525 or later; this needs no reboot. If automatic updates are off, run contentscannerupdate and confirm the result with contentscannerstatus. Alternatively, upgrade AsyncOS to 15.5.5-014 (15.5 branch) or 16.5.0-780 (16.5 branch). Version 16.0 gets no fix, so move from 16.0 to 16.5.0-780.
  • Before an AsyncOS upgrade, especially on a virtual appliance, run grep "System Security" system_logs on every gateway and cluster member, because the upgrade can destroy forensic data. If it reports 'Suspected compromise indicator was found', start incident response. If it reports 'Security scan did not complete', contact Cisco TAC. If it reports 'No compromise indicator was found', still patch immediately.
  • Patch gateways that receive mail from the internet first.
  • Check logs held outside the gateway (firewall, SIEM) for unexpected uploads from the gateway to outside IPs, or downloads from unknown IPs.
  • Apply Cisco's hardening guidance (cisco-sa-hardening-esa-dfCrfXkm): restrict internet access to the appliance's management interface and put it behind a firewall; send logs to an external server; keep mail and management functions separate; turn off HTTP, FTP and HTTP admin access; use SAML or LDAP and strong admin passwords.
  • Hardening only reduces exposure. It does not make an unpatched gateway safe, and Cisco says there is no workaround: only the CST update or the AsyncOS upgrade fixes the vulnerability.

ReconX customers see the full notice - and their own systems

Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.

In ReconX: the full analysis, 6 open questions, followed up as sources answer, all 9 sources with their dates and every revision. And technology matching: which of your systems run Cisco Secure Email Gateway (AsyncOS), at which version, fixed or not - and what each one needs.

Sign in to ReconXAbout ReconX

Main sources

Known exploited: Cisco Secure Email Gateway - Cisco Secure Email Gateway Relative Path Traversal Vulnerability Vendor · NCSC-2026-0429 [1.00] [H/H] Kwetsbaarheid verholpen in Cisco Secure Email Gateway CERT · 2026-017: Critical Vulnerability in Cisco Secure Email Gateway CERT

Data: GreyNoise - CVE-2026-76519 (estimate, 26/10/2026)

← All Watchtower notices

Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.

ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.