Cisco is warning that attackers are exploiting a maximum-severity flaw in its Secure Email Gateway, an appliance that filters mail for hospitals, insurers and laboratories across the country. The bug lets an unauthenticated sender write files to the appliance’s operating system by sending a crafted attachment, then run commands as root.
The flaw, tracked as CVE-2026-76519, carries a CVSS score of 9.8. Cisco found it through internal scanning and learned of in-the-wild attacks in October. A gateway is exposed only if the File Reputation service, part of the Advanced Malware Protection feature for attachments, is enabled and assigned to a mail policy, and the Content Scanner Tools package predates version 25.3.0.5525.
Both conditions must hold. Physical and virtual gateways on vulnerable AsyncOS releases are affected, while Secure Email and Web Manager and the Secure Web Appliance are not.
Fixes have been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, and as a Content Scanner Tools update to 25.3.0.5525 or later that installs without a software upgrade or restart. Operators of the managed cloud service got direct notice: accounts whose equipment carried signs of a possible intrusion were alerted by the vendor, which is running cleanup for them. Nothing is required of those administrators.
Healthcare organizations should confirm their Content Scanner Tools version, apply the update, and review mail gateway logs for unexpected file writes or root-level command activity. Because the appliance is a pre-authentication entry point into the environment, a compromise can expose inbound patient correspondence and the credentials and identities flowing through clinical mail.
