Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise.

Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system.

“A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.” reads the advisory. “This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.”

The networking giant found this one in its own internal security scanning, which is at least some comfort, and became aware of active attacks in October.

The advisory highlights that cleanest that not every Cisco email gateway is vulnerable. The File Reputation service, part of the Advanced Malware Protection feature, has to be enabled and assigned to a mail policy, and the Content Scanner Tools version has to be earlier than 25.3.0.5525. If either condition doesn’t apply, the attack path doesn’t exist.

Checking is fast. To verify File Reputation status, open the web management interface and navigate to Mail Policies, then Advanced Malware Protection for either incoming or outgoing policies. To confirm the scanner version, run contentscannerstatus at the CLI. If the output shows anything older than 25.3.0.5525, the device is exposed.

The cleanest remediation is updating the Content Scanner Tools package.

“Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied.” continues the advisory. “Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.”

Gateways with automatic updates enabled should check that the update has been installed by verifying the scanner version. If automatic updates are disabled, administrators can run contentscannerupdate from the command line to install it manually.

Cisco has also released fixes in AsyncOS versions 15.5.5-014 and 16.5.0-780. Version 16.0 has no fixed release, so users must migrate to another version. Cisco recommends upgrading any version older than 16.5 directly to 16.5.0-780. Cisco-managed Secure Email Cloud customers are already protected and don’t need to take any action.

Cisco’s compromise check is a single command: grep "System Security" system_logs. It returns one of three outputs: a confirmed compromise indicator, a scan that failed to complete, or a clean result. The last one isn’t a guarantee, though.

“Upon successful exploitation of this vulnerability, attackers may obtain command execution with root privileges. With this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise.” states the advisory. “Cisco strongly recommends that cross-checking the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”

That means a clean log result isn’t proof the device wasn’t compromised. Cisco strongly recommends also pulling firewall and network logs from outside the appliance to look for unexpected uploads to external addresses or downloads from suspicious ones.

For virtual appliances, Cisco recommends rebuilding the system if it has been compromised. First, save forensic data, as upgrading the affected system will destroy it. Then deploy a new virtual machine with a fixed software version, rebuild the configuration from scratch without importing old configuration files, and change all credentials and cryptographic keys. Clustered systems need extra care because SSH keys are used to authenticate between members. If one system is compromised, its private keys could put the others at risk.

This is the third Cisco email gateway flaw that attackers have exploited to gain root access since December 2025. Previous incidents involved a SQL injection flaw reported in September and a zero-day in the spam quarantine feature. Cisco has now confirmed that attackers are exploiting two vulnerabilities disclosed in a September security update.

Read the full Cisco advisory for indicators of compromise and details of the fixed releases.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISCO)

Cisco warns of a critical zero-day in Secure Email Gateway, exploited in the wild to gain root access through malicious emails.

Cisco disclosed a critical zero-day, tracked as CVE-2026-76461 (CVSS score of 9.8), affecting Secure Email Gateway appliances. The flaw can be exploited remotely without authentication. Attackers can send specially crafted emails containing malicious SQL statements, triggering arbitrary command execution on the underlying system with root privileges. Cisco confirmed the vulnerability is already being exploited in the wild.

“A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.” reads the report published by the networking giant.

“This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.”

According to the advisory, the vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration. The company states that there are no workarounds that address this issue.

Recently, the company’s PSIRT became aware of active exploitation of this vulnerability.

Check Secure Email Gateway logs for suspicious SQL statements to detect possible exploitation. If the device is part of a cluster, check every device. Cisco says customers using Secure Email Cloud may not be able to check these indicators themselves, but those with detected malicious activity were contacted directly.

“To confirm any attempted exploitation of this vulnerability, review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, review the logs of each cluster device.” states the advisory. “The following is a non-exhaustive example of how a malicious SQL statement could be detected in the logs:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

The presence of any entry in the output may indicate malicious activity.”

On September 14, US CISA added CVE-2026-76461 to its Known Exploited Vulnerability to Catalog (KEV) and ordered federal organizations to address it by September 17.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Secure Email Gateway)

Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.

Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical authentication bypass that lets unauthenticated attackers remotely bypass security controls, run scripts and potentially gain root access. Attackers also exploit CVE-2026-20316 to access sensitive data through a low-privilege account. The second flaw can be chained with other FMC vulnerabilities to increase privileges.

Cisco linked the attacks to ransomware operations, including Qilin, as well as state-sponsored activity.

“Talos’ analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors, as described below.” reads the advisory. “The first cluster which we track as UAT-12197, involves the exploitation of CVE-2026-20079, leading to the deployment of web shells, a Java Archive (JAR)-based command executor, and credential exfiltration.”

Talos identified three attack clusters targeting Cisco Secure Firewall Management Center (FMC). The first cluster deploys JSP-based web shells and custom command executors into Tomcat webroot directories to query internal databases and harvest user authentication data and credentials.

“This cluster of activity involved the successful exploitation of CVE-2026-20079 and the subsequent placement of a malicious web shell in the CSM Tomcat webroot directory.” reads the report. “The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:”

The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “Cyclops Blink” for persistent access, DNS over HTTPS resolution, and packet sniffing.

“The threat actor obtained initial access to compromised systems by either exploiting CVE-2026-20079 or via static credentials.” Talos states. “After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:”

The third cluster involves Qilin ransomware operators (UAT-11988) who use static credentials for initial access, perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware.

“Once extensive reconnaissance was completed, the threat actor attempted to establish persistent network access into the victim organization using a Python SOCKS5 proxy (socks5.py) and a reverse-SSH tunnel from the FMC back to the attacker’s own remote host. The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report. “The threat actor conducted extensive probing of endpoints in the victim’s environment, deployed open-source tooling such as impacket, Invoke-TheHash, and custom-made AV killers — all followed by the deployment of the Qilin ransomware on selected endpoints.”

Cisco strongly urges customers to immediately apply released hotfixes and update detection rules using the provided Snort SIDs while awaiting upcoming comprehensive security hardening updates.

CISA added CVE-2026-20079 to its KEV catalog, requiring U.S. federal agencies to patch it by September 12, 2026. CVE-2026-20316 was added in late July.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco FMC)