Cisco's email gateway is under attack. Check the scanner update, then check for compromise.
Cisco has fixed an actively exploited email gateway flaw. A scanner update can close the hole without a restart, but suspected compromise needs a separate response.
If your organization uses Cisco Secure Email Gateway, check its Content Scanner Tools version today. Cisco disclosed an actively exploited vulnerability on October 14 that can let an attacker take control of an affected appliance by sending an email with a specially crafted attachment through it.
The flaw, CVE-2026-76519, affects the gateway's Advanced Malware Protection feature. Cisco rates it critical, with a severity score of 9.8 out of 10. CISA has also added it to its Known Exploited Vulnerabilities catalog. This is a problem with the system processing the mail, so telling staff to avoid opening attachments does not address the vulnerable gateway.
There is a useful detail in Cisco's advisory: an updated scanner package fixes this vulnerability without a full software upgrade or a restart. That makes checking the installed version worth doing now. It does not tell you whether someone got in before the fix arrived.
Check whether your gateway is affected
Cisco says physical and virtual gateways are affected when they run vulnerable AsyncOS software and meet both of these conditions:
- File Reputation is enabled and assigned to a mail policy.
- Content Scanner Tools is older than 25.3.0.5525.
In the management interface, look under Mail Policies, then Incoming Mail Policies or Outgoing Mail Policies, then Advanced Malware Protection. Open the relevant policy and inspect whether Enable File Reputation is already checked; you are checking its status, not turning it on. At the appliance command line, contentscannerstatus shows the scanner version.
If someone else manages your email service, send them the advisory and ask them to confirm the installed version and whether they have checked for signs of compromise. A report that the system is generally up to date is less useful than that specific answer.
The scanner fix may already be installed
Cisco says Content Scanner Tools 25.3.0.5525 and later contain the fix, distributed to licensed and supported AsyncOS releases. If automatic updates have already applied it, customers do not need to take action for that scanner update. Verify rather than assume.
Administrators who disabled automatic updates can request the package with contentscannerupdate, then check the version again. Cisco also lists fixed AsyncOS releases and recommends that customers running versions earlier than 16.5 migrate to 16.5.0-780. Use the advisory's release guidance for your appliance; the scanner fix should not become a reason to ignore the wider software upgrade.
For Cisco Secure Email Cloud Gateway, Cisco says the fixed scanner is already deployed. Customers contacted about possible compromise still need to follow the recovery guidance.
A patched gateway may still need investigation
Cisco's advisory explains how to review System Security entries in the appliance logs. Check every device in a cluster. A suspected-compromise message or an incomplete security scan needs follow-up with Cisco's support team.
A clean local log is not conclusive. Cisco warns that attackers with root access can hide or remove evidence, and recommends checking separate firewall and network logs for suspicious transfers.
If you suspect compromise, preserve evidence before changing the system. Cisco specifically warns that upgrading a compromised virtual instance destroys forensic data and logs. Its recovery guidance for virtual appliances includes deploying a fresh machine, rebuilding the configuration without importing old configuration files, and renewing credentials and cryptographic material. Physical appliances have a separate support-led response.
Read that recovery section before treating an upgrade as the whole repair. Closing the vulnerability prevents further exploitation of that hole; it does not establish that an already-compromised appliance is trustworthy.
Comments ()