For CVE-2026-76519 you do not need a full AsyncOS upgrade if you can update Content Scanner Tools to 25.3.0.5525+. CLI: contentscannerstatus then contentscannerupdate (or enable Security Services → Service Updates → Automatic Updates). Confirm File Reputation is only on policies that need it, restrict management exposure, and ship system_logs off-box before you rebuild a suspected-compromised node—root on the box can scrub local evidence.