CISA adds actively exploited Cisco Secure Email Gateway flaw to KEV catalog

CISA added CVE-2026-76519, a Cisco Secure Email Gateway flaw, to its Known Exploited Vulnerabilities catalog on October 14, 2026.

Unauthenticated attackers can gain root. The vulnerability in the Advanced Malware Protection feature lets a remote attacker write arbitrary files by sending an email with a crafted attachment through an affected device when the file reputation service is enabled. Cisco says a successful exploit can let the attacker execute commands with root privileges. Cisco, the CVE numbering authority, rates it 9.8 under CVSS 3.1.

Cisco confirmed attacks this month. Cisco PSIRT became aware of active exploitation in October 2026. The flaw was found during internal security scanning.

Updates are the only fix. Cisco has released software updates and says there are no workarounds. It recommends that customers on AsyncOS releases earlier than 16.5 migrate to 16.5.0-780.

Federal agencies have until October 17. Under BOD 26-04, agencies must apply vendor mitigations by that date and follow CISA's forensic triage requirements, or stop using affected instances if mitigations are unavailable.