A CVSS 9.8 flaw lets an unauthenticated sender reach root on the appliance, and CISA has set a federal patch deadline.
The Hacker News reports that Cisco has confirmed active exploitation of CVE-2026-76519, a critical flaw, CVSS 9.8, in its Secure Email Gateway. An unauthenticated sender can get the appliance to write files to its own operating system through a crafted attachment, then run commands as root. Devices are exposed when the File Reputation service, part of Advanced Malware Protection, is enabled on a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525, and Cisco says there is no workaround.
CISA has added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until October 17, 2026 to patch. Cisco's advisory does not say how many devices have been hit or who is behind the attacks. It is the third root-level flaw in these appliances that Cisco has confirmed exploited since December, and gateways with automatic Content Scanner Tools updates enabled need no further action once that update applies.
Why it matters: email gateways sit at the network edge and are a direct path to root, so the gap between an unauthenticated CVSS 9.8 bug and a federal patch deadline is closing fast. Enterprises running these appliances should confirm scanner versions are current and treat any unmanaged edge device as a priority in cloud and security operations.