What happened

• Cisco warned that CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway is being exploited [S1].
• An unauthenticated sender can use a crafted email attachment to write files to the appliance OS and potentially run commands as root [S1].
• Only gateways with File Reputation enabled on a mail policy and Content Scanner Tools older than 25.3.0.5525 are vulnerable [S1].
• Cisco has contacted managed Secure Email Cloud customers whose gateways show possible compromise indicators [S1].
• Cisco published a CLI check (grep "System Security" system_logs) and advises reviewing firewall logs for unexpected uploads to external IPs or downloads from malicious ones [S1].

Timeline

Detect

Cisco SEG 'System Security' compromise messages · Cisco Secure Email Gateway system_logs (forwarded via syslog or retrieved from the appliance)

index=* "System Security:" | stats count min(_time) as first_seen max(_time) as last_seen values(_raw) as messages by host

FROM logs-* | WHERE message LIKE "*System Security:*" | STATS count = COUNT(*), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), messages = VALUES(message) BY host.name

A hit means: The appliance logged one of Cisco's three 'System Security' messages. 'Suspected compromise indicator was found' means Cisco's check flagged the gateway; per the message, contact TAC [S1].

Unexpected outbound transfers from the email gateway · Firewall / network flow logs outside the appliance

index=* src_ip="<SEG_IP>" earliest=-30d | stats sum(bytes_out) as bytes_out sum(bytes_in) as bytes_in values(dest_port) as dest_ports count by dest_ip | sort - bytes_out

FROM logs-* | WHERE @timestamp >= NOW() - 30 days AND source.ip == "<SEG_IP>" | STATS bytes_out = SUM(source.bytes), bytes_in = SUM(destination.bytes), dest_ports = VALUES(destination.port), count = COUNT(*) BY destination.ip | SORT bytes_out DESC

A hit means: Large uploads to unfamiliar external IPs, or downloads from known-bad IPs, match the post-exploitation activity Cisco tells defenders to look for [S1]. Replace <SEG_IP> with each gateway's address.

Verify

• On the appliance CLI, run grep "System Security" system_logs. It returns one of three 'System Security' messages [S1].
• On the appliance CLI, run contentscannerstatus. A version older than 25.3.0.5525 together with File Reputation enabled on a mail policy means the gateway was exposed [S1].
• Benign look-alikes for outbound traffic: normal mail delivery (SMTP), Cisco update, telemetry and reputation lookups, and file-reputation or sandbox cloud queries. Baseline these destinations before treating an upload as suspicious.
• The meaning of the other two 'System Security' messages is not given in the source. Confirm it against Cisco's advisory before closing a hit.

Scope

Affected

• Cisco Secure Email Gateway appliances [S1]
• Managed Secure Email Cloud gateways (Cisco is contacting customers showing indicators) [S1]

Only if

• File Reputation is enabled on a mail policy [S1]
• Content Scanner Tools version is older than 25.3.0.5525 [S1]

Not affected if

• Content Scanner Tools is 25.3.0.5525 or later [S1]
• File Reputation is not enabled on any mail policy [S1]

Fixed in: Content Scanner Tools 25.3.0.5525 or later [S1]

Enumerate

• Every Secure Email Gateway, including on-premises, virtual and Cisco-managed cloud instances
• Content Scanner Tools version per gateway (contentscannerstatus)
• Mail policies with File Reputation enabled, per gateway
• system_logs 'System Security' results per gateway
• Any Cisco notice of compromise indicators received for cloud tenants
• Firewall egress records from each gateway's IP since before the advisory

Contain

• Preserve evidence first: export system_logs and firewall/flow logs for each gateway before any change. Upgrades or rebuilds may overwrite appliance state, and that cannot be undone.
• Bring Content Scanner Tools to 25.3.0.5525 or later on every gateway [S1].
• For any gateway that returns 'Suspected compromise indicator was found', contact Cisco TAC as the message directs [S1]. Restrict that gateway's outbound traffic to required mail and Cisco destinations while TAC engages.
• Block external IPs found receiving uploads from, or sending downloads to, a gateway.

Eradicate

• The source does not describe attacker persistence or written file paths. Follow Cisco TAC's guidance for remediating a flagged appliance [S1].
• Treat credentials and keys stored on a flagged gateway (admin accounts, TLS keys, LDAP/SMTP auth bindings) as candidates for rotation, pending the appliance's root exposure being confirmed.

Recover

• Before restoring trust, confirm contentscannerstatus shows 25.3.0.5525 or later and that the 'System Security' check is clean [S1].
• After restoring, monitor gateway egress in firewall logs for uploads to external IPs or downloads from malicious ones [S1].
• Re-run the 'System Security' check on a schedule until Cisco's advisory is final.

Re-enter the loop when

• Cisco publishes IoCs, file paths or attacker IPs for CVE-2026-76519
• Cisco changes the affected conditions or fixed version, or adds mitigations
• Details emerge on CVE-2026-76461 and its relation to this campaign
• Cisco notifies the organisation's managed cloud tenant of indicators
• Any gateway returns a 'System Security' compromise message or shows anomalous egress

Debrief

• Record per-gateway exposure: scanner version, File Reputation state, check result and dates.
• Record the time from advisory to patch, and whether the 'System Security' messages reached the SIEM.
• Gaps: no primary Cisco advisory supplied; no IoCs, persistence details, attack start date or attribution; CVE-2026-76461 named without detail.

Detection coverage — checked automatically

Checked automatically 2026-11-10 07:59Z from public sources: 10 published, 24 nothing found, 0 not machine-checkable, 2 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-76461 — Cisco Secure Email Gateway file-write flaw CVE-2026-76519 under active exploitation; CVE-2026-76519 — Cisco Secure Email Gateway file-write flaw CVE-2026-76519 under active exploitation. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-76519

vuln:CVE-2026-76461

http.title:"Cisco IronPort"

http.html:"Email Security Appliance"

http.title:"Cisco Email Security Appliance"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (Cisco Secure Email Gateway, Managed Secure Email Cloud) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"Cisco Secure Email Gateway", http.component:"Cisco Secure Email Gateway", product:"Managed Secure Email Cloud", http.component:"Managed Secure Email Cloud", host.services: (software.product = "Cisco Secure Email Gateway"), host.services: (software.product = "Managed Secure Email Cloud").

Banner spellings: a model read 6 from the NVD names and this card's text (former and marketing names, console titles); 3 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 07:59Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What is CVE-2026-76461, and how does it relate to CVE-2026-76519? The story lists it without detail.
• Is disabling File Reputation on mail policies a Cisco-supported interim mitigation? S1 lists it as a condition, not as a mitigation.
• What do the other two 'System Security' messages say and mean?
• When did exploitation begin, and are there published IoCs or attacker infrastructure?
• The CISA KEV listing appears in the brief context but not in the supplied sources. Verify it, along with any due date.

Sources

• [S1] https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.