An unauthenticated attachment bug on Cisco’s email security appliance was already being abused before any repair shipped, so the vendor wants administrators to patch without delay. CVE-2026-76519 is the identifier attached to this bug, whose severity score stands at 9.8.
Where the exposure lives is the appliance’s Advanced Malware Protection feature. When the File Reputation service is enabled and the Content Scanner Tools build falls below 25.3.0.5525, a sender who never authenticates can craft an attachment that drops files directly onto the host operating system. What follows is command execution with root privileges.
According to Cisco, active exploitation surfaced in October 2026. Indicators of compromise were released, though the company warned that someone holding root access can wipe away traces of the break-in. Administrators are urged to look past the appliance itself and comb through firewall and network logs for unusual uploads to or from foreign addresses.
The repair came in September as AsyncOS versions 15.5.5-014 and 16.5.0-780, at first carrying a different tracking number. Cisco has since separated the identifier and republished its advisory.
Blunt guidance applies to virtual appliances: build a fresh virtual machine from patched code, recreate product configuration from scratch, rotate every credential, and hold onto the old image for forensics. For physical appliances showing signs of compromise, the vendor points owners to its Technical Assistance Center.
Federal civilian agencies must act by Saturday, because CISA has added this flaw to the list of known exploited vulnerabilities that it maintains.
