CISA KEV deadline: — patch or disconnect affected gateways by this date.
Cybersecurity news: Cisco confirms CVE-2026-76519 is being exploited in the wild: an unauthenticated attacker sends one email with a crafted attachment through your Secure Email Gateway, and the gateway's own malware inspection hands over root command execution. Nobody has to open anything. CISA added it to the Known Exploited Vulnerabilities catalog on October 14 with a patch deadline of October 17 for federal agencies. This free CVE check tool tells you if your gateway is exposed. No signup, nothing installed.
Key figure: CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries as of October 16, 2026, every one confirmed exploited in the wild (CISA KEV catalog, version 2026.10.16).
Direct answer: you are vulnerable if your Secure Email Gateway runs an unpatched version AND is reachable with the vulnerable service enabled. Both must be true — but with unauthenticated root RCE and active exploitation, check now rather than reasoning about it. The 30-second check below walks you through it.
Check your Content Scanner Tools version — on the appliance CLI:
contentscannerstatus
Check whether File Reputation is armed — in the web UI go to Mail Policies > Incoming Mail Policies > Advanced Malware Protection (and the same under Outgoing), open each mail policy, and look at the "Enable File Reputation" checkbox:
Not affected regardless: Secure Email and Web Manager, Secure Web Appliance, and Secure Email Cloud (Cisco already deployed the fix there and contacted customers showing compromise indicators).
Fix it — no workaround exists:
contentscannerupdate
This page checked one CVE. BreachHunter hunts attacker infrastructure and compromise indicators — the footholds attackers keep after the initial exploit.
CVE-2026-76519 (CVSS 9.8) is a relative path-traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway. A remote, unauthenticated attacker can send an email with a crafted attachment; while the gateway inspects it, the attacker writes arbitrary files and executes commands with root privileges. Nobody needs to open the attachment.
Two conditions must both be true: (1) the File Reputation service is enabled and assigned to a mail policy (Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection), and (2) the Content Scanner Tools version is earlier than 25.3.0.5525 — check with the 'contentscannerstatus' CLI command. If both hold, the gateway is exploitable.
Install Content Scanner Tools 25.3.0.5525 or later — no restart required (run 'contentscannerupdate' or rely on automatic updates). For the long term, upgrade to AsyncOS 15.5.5-014 or 16.5.0-780. There is no workaround. If you suspect compromise, Cisco advises deploying a fresh VM on a fixed release, rebuilding the config from scratch, and rotating credentials.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.