Cisco on Wednesday warned customers that hackers have been exploiting a critical-severity vulnerability in Secure Email Gateway.
Tracked as CVE-2026-76519 (CVSS score of 9.8/10), the security defect impacts the Advanced Malware Protection (AMP) feature of the appliance and could allow remote, unauthenticated attackers to write arbitrary files on the operating system.
“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” Cisco warns.
The flaw exists in the handling of email attachments if the file reputation service has been enabled and if a Content Scanner Tools version earlier than 25.3.0.5525 is installed.
Attackers could send emails containing crafted attachments to trigger the security hole, write arbitrary files on the underlying OS, and execute arbitrary commands with root privileges.
Cisco has published indicators of compromise (IoCs) to help organizations hunt for potential intrusions, but warns that attackers may abuse their elevated access to remove or hide evidence of exploitation.
Organizations should check network and firewall logs outside of the affected devices to discover suspicious activity such as unexpected uploads or downloads to and from external IP addresses.
Cisco has advised customers to contact its Technical Assistance Center (TAC) if they suspect exploitation on a physical device.