decrypted · 15 october 2026 · vulnerabilities and patching · uk policy and law

Cisco's email gateway is exploited again: the scanner with the keys

On Wednesday Cisco confirmed that attackers are already exploiting a new flaw in its Secure Email Gateway, the appliance that screens inbound mail for a great many UK organisations. This morning's post was about hardware that arrives compromised. This is the reverse: a trusted box, installed deliberately, whose whole job is to open everything strangers send you.

What Cisco has said

The flaw is CVE-2026-76519, scored 9.8 out of 10 under CVSS 3.1. Cisco's advisory describes a relative path traversal in how the gateway handles attachments. An unauthenticated attacker can write arbitrary files and run commands as root, with no user interaction. Cisco said it became aware of active exploitation in October 2026. It has not said who is behind it or how many appliances are affected.

Not every gateway is exposed. The appliance must have the File Reputation service enabled and assigned to a mail policy, and run Content Scanner Tools earlier than 25.3.0.5525. Cisco lists no workaround. The fixes are AsyncOS 15.5.5-014 or 16.5.0-780, or the newer scanner tools, which can be applied without an upgrade or restart. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 14 October.

How it works, in plain English

Picture a mailroom with an X-ray machine for parcels. The machine is trusted, so it sits inside the building with the keys to every door. Now imagine a parcel that, once scanned, tells the machine to rewrite its own instructions and let someone in. Nobody has to open the parcel or click anything. The attacker simply posts it. Here the parcel is an email attachment, and the keys are root access to a device that sees all of your mail.

What the defender sees

One analysis of the advisory suggests checking the scanner version with the contentscannerstatus command and searching system_logs for "System Security" messages, including a "Suspected compromise indicator". It also warns that a clean scan does not rule out compromise, so firewall telemetry matters: unexpected uploads, odd downloads, connections to addresses you do not recognise. For a virtual appliance that was hit, the advice is to preserve evidence, rebuild on a fixed release without importing the old configuration, and treat cluster SSH keys as exposed.

This is not Cisco's first such flaw this autumn. CVE-2026-76461, another unauthenticated root flaw triggered by crafted email, was fixed in September, according to the same analysis.

The Secure by Design lesson

Two questions for the board. First: why does a component that parses hostile files run with root? Least privilege and sandboxing are design decisions, cheap on day one and costly to retrofit. Second: why can your security tooling be reached by the world, and is it watched as closely as your servers?

Palo Alto Networks offers the same lesson on the same day. Its CVE-2026-0322 is a code injection in the PAN-OS management interface, scored 8.6 under CVSS 4.0, and it needs valid credentials plus network access to that interface. The vendor reports "very limited exploitation". Its own advice is to restrict management access to trusted internal addresses or a single jump box.

Practical steps: inventory every gateway and firewall, confirm who owns patching, take management interfaces off the public internet, and decide in advance how you would rebuild a box you no longer trust. Opinion, not advice.

Also this week

Legal Aid Agency, the damage grows. The agency's update of 14 October puts about 250,000 records from before 2007 in scope of the April 2025 attack, the earliest verified dating from 1978. It also confirms that probation data on a relatively small number of offenders supervised between 2010 and 2017 was taken, more than 99% of it from 2016 and 2017. The agency says it has no indication the stolen data has been published or shared. The Ministry of Justice and the agency list stronger authentication, tighter access controls, better monitoring and the retirement or isolation of higher-risk technology among their fixes. The design lesson is retention: records kept for decades are decades of liability, and eighteen months to establish what was taken is a reminder that you cannot account for data you have not inventoried.

NCSC publishes post-quantum TLS settings. On 15 October the NCSC updated its TLS guidance with recommended post-quantum configurations, following IETF RFC 10024 on hybrid key agreement for TLS 1.3. The catch for many estates: only TLS 1.3 supports post-quantum cryptography, and TLS 1.2 will not be upgraded. The NCSC says high priority migration activities should be carried out by 2031, and that data in transit will fall into that category for many organisations. It also plans to update its IPsec guidance as the relevant RFCs are finalised, and to add post-quantum authentication recommendations for TLS in the coming months. The Secure by Design reading is simple: you cannot migrate what you cannot find, so start by listing every system still speaking TLS 1.2.

Sources

If you want a second pair of eyes on your perimeter or your data retention, get in touch.