Cisco Secure Email Gateway Flaw Gives Attackers Root, and It Is Being Exploited

Cisco has patched CVE-2026-76519, a critical flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway that lets an unauthenticated attacker write files and run commands as root by sending a crafted email attachment through the device. Cisco's PSIRT says it is aware of active exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14.

A gateway is exposed only when two conditions both hold: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525. Cisco says there are no workarounds, so the fix is the only remedy.

What happened

Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 2026-10-14 for what it titles "Cisco Secure Email Gateway Arbitrary File Write Vulnerability" (bug ID CSCwu56223). It rates the flaw 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and classifies it as CWE-23, relative path traversal. NVD lists Cisco's score and shows its own analysis as still pending.

Cisco states: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." It gives no date, no description of the attacks and no indicators such as IP addresses or file hashes. Cisco says it found malicious activity on some Secure Email Cloud devices and has contacted those customers directly. CISA's KEV entry has a federal due date of 2026-10-17, three days after it was added. CISA lists known ransomware use as "Unknown". (We covered an earlier exploited Cisco flaw, the SD-WAN Manager zero-day.)

Cisco says the flaw was found during internal security scanning; no outside researcher is credited.

The timeline is short: Cisco published the advisory on 2026-10-14 at 16:00 GMT, CISA added the flaw to KEV the same day, and the federal deadline falls on 2026-10-17.

Why it matters

The flaw combines pre-authentication, network reachability, no user interaction and root-level code execution on a device that sits on the mail path and handles every inbound attachment (we covered another exploited email gateway flaw in FortiMail). Cisco notes that on a compromised appliance, the private SSH keys used between cluster members could be accessed, so one compromised gateway can put the others in a cluster at risk.

Cisco also warns that an attacker with root "may remove or hide evidence of exploitation", so a clean result on the device does not by itself prove it was not hit.

Technical details

Cisco describes an improper handling of email attachments in AMP when the file reputation service is enabled. A crafted attachment sent through an affected device triggers an arbitrary file write and command execution with root privileges. Cisco has not published further exploit mechanics, and we do not speculate beyond the advisory.

A device is vulnerable when all of these hold, per Cisco:

• It is a physical or virtual Secure Email Gateway running a vulnerable AsyncOS release.
• File Reputation (part of AMP) is enabled and assigned to a mail policy.
• Content Scanner Tools is older than 25.3.0.5525.

Affected and fixed releases

Fixed AsyncOS builds for CVE-2026-76519; 16.0 has none

Cisco strongly recommends that customers on releases earlier than 16.5 migrate to 16.5.0-780. It also distributes the fix through Content Scanner Tools 25.3.0.5525 and later for all licensed and supported AsyncOS releases, and that update needs no software upgrade or restart. Cisco lists Secure Email and Web Manager and Secure Web Appliance as not affected.

What defenders should do

1. Check exposure. In the web interface, open Mail Policies > Incoming Mail Policies (and Outgoing Mail Policies) > Advanced Malware Protection and see whether "Enable File Reputation" is checked. Run contentscannerstatus on the CLI to read the Content Scanner Tools version.
2. Update Content Scanner Tools now. Run contentscannerupdate, or turn on automatic updates under Security Services > Service Updates. Cisco says no restart is needed, and that customers who have enabled automatic updates are not required to take any action once the update has been applied. Confirm the version is 25.3.0.5525 or later.
3. Plan the AsyncOS upgrade. Move 15.5 to 15.5.5-014 and 16.5 to 16.5.0-780. Anyone on 16.0 has no fixed 16.0 build to install and should plan a migration to 16.5.0-780.
4. Look for compromise. Run grep "System Security" system_logs on each cluster member. Cisco's possible results are a suspected-compromise message, a scan that did not complete, or no compromise indicator. If the result is a suspected compromise, follow Cisco's recovery steps in step 5; if the security scan did not complete, contact Cisco TAC. Also review network and firewall logs outside the device for unexpected uploads to external IPs or downloads from malicious ones, as Cisco advises.
5. If you find signs of compromise. On a virtual appliance, record forensics first, because upgrading destroys data and logs. Cisco then says to deploy a new VM on a fixed release, rebuild the configuration without importing old config files, and renew credentials and cryptographic material. Restore every member of a cluster that contains a compromised appliance. For physical appliances, contact TAC with remote access enabled.

Secure Email Cloud Gateway customers need to take no patching action: Cisco says the fixed Content Scanner Tools are already deployed. Cisco also says it investigated cloud devices, has directly contacted customers where indicators of possible compromise were identified, and is engaged in remediation and recovery. Cisco strongly recommends that contacted customers renew credentials and cryptographic material on the appliance and restrict access to it.

Cisco's general advice also bears on this flaw: prevent internet access to the appliance, and where it is required, limit access to known, trusted hosts.

US federal agencies must follow CISA's BOD 26-04 and its Forensics Triage Requirements (the KEV entry flags forensic triage as required) by the 2026-10-17 due date, or discontinue use of the product if mitigations are unavailable. Other organizations should treat that date as a reasonable benchmark given confirmed exploitation.

What is still unclear

• Cisco does not say when exploitation began, how widespread it is or what attackers did after gaining access. No actor or victim has been named, and we do not attribute the activity.
• No indicators of compromise beyond the on-device log check have been published.
• NVD's analysis is pending, and its affected-version data lists more releases than Cisco's fix table, including 13.0 to 15.0 builds and 16.0.0-050 to 16.0.4-016, so older trains should plan to migrate too. Rely on Cisco's advisory for fix guidance, and check back as both are updated.
• Cisco's advisory is at its first version, so details may change.

Sources

• Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
• NVD, CVE-2026-76519: https://nvd.nist.gov/vuln/detail/CVE-2026-76519
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519