In mid-September, Cisco disclosed that attackers were already exploiting CVE-2026-76461, an SQL injection in the way AsyncOS parses email that gave an unauthenticated sender root on the gateway. This week there is a second one. The Register reports that Cisco has confirmed exploitation of CVE-2026-76519, a CVSS 9.8 flaw in how the Advanced Malware Protection feature handles email attachments, and that CISA added it to the Known Exploited Vulnerabilities catalog on 14 October with a Saturday deadline for federal agencies. At the time of writing we could only find that one report using the identifier, so check Cisco's advisory directly before you act on the number.
What this one needs
According to The Register, a remote, unauthenticated attacker can write files and run commands as root by sending a crafted message. Unlike the September bug, which hit every gateway whatever its configuration, this one only matters if two conditions are both true: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is older than 25.3.0.5525. Cisco says there is no workaround, and customers on releases before 16.5 are pointed to 16.5.0-780. It would not say how many appliances had been compromised, describing the affected customers as a limited number.
That conditional exposure is useful and also a trap. It is useful because you can answer "are we affected?" in a few minutes. It is a trap because File Reputation is the kind of setting that gets turned on once, by someone who has since left, and forgotten.
Why mail gateways keep ending up here
A mail gateway is built to accept the one thing nobody can refuse to receive: arbitrary content from strangers. VulnCheck's Spencer McIntyre made the point about the September flaw that it would be easy for an attacker's message to reach the device, since filtering such messages is its job. It also tends to sit with broad network access and credentials for directory lookups. A root shell there is a good place to start from.
What to do today
- Identify every Secure Email Gateway, physical and virtual, including the ones in a disaster recovery site that nobody looks at.
- Check the File Reputation setting and the Content Scanner Tools version using the steps in Cisco's advisory. If both conditions are met, upgrade before anything else.
- If you patched for CVE-2026-76461 last month and stopped there, you are not finished. Confirm which release you are running now.
- For a virtual appliance you suspect was reached, Cisco's guidance for the September bug was to keep forensic evidence before you deploy a fresh machine on the fixed version. The same logic applies here.
- Review which accounts the gateway holds, such as LDAP binds and relay credentials, and rotate them if there is any doubt.
- Restrict outbound connections from the gateway to the destinations it actually needs, so a compromised box cannot call out freely.
Two exploited root flaws in the same product family in five weeks is enough to justify a conversation about whether the gateway sits in a segment of its own. We are happy to help with that; email sales@halfteck.com.