Quick links
Press Enter to search, Esc to close
Exploited vulnerability
A critical arbitrary file write flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway.
In short
CVE-2026-76519 is a critical arbitrary file write flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway. Cisco says an unauthenticated remote attacker could write files and run commands as root by sending an email with a crafted attachment through an affected device. It is rated CVSS 9.8, Cisco has seen it exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on 14 October 2026.
Cisco says an unauthenticated, remote attacker could write arbitrary files on the operating system of the appliance. The cause is improper handling of email attachments when the file reputation service is enabled. The attacker sends an email with a crafted attachment through an affected device. A successful exploit could let the attacker write files and run commands with root privileges. The CVSS vector is network, low complexity, no privileges and no user interaction.
Root access on a mail gateway is serious, because the device sits on the path of company email. Cisco warns that an attacker with root can remove or hide evidence of the break-in. It also says the private SSH keys that cluster members use to trust each other could be read on a compromised appliance. That may let the attacker reach the other members of the cluster.
CISA lists the flaw as a relative path traversal, while Cisco calls it an arbitrary file write. Both names describe the same CVE. CISA's catalog entry says use in ransomware campaigns is unknown. Cisco says it found the flaw during internal security scanning.
Cisco Secure Email Gateway, physical and virtual, when it runs a vulnerable AsyncOS release and both of these are true. The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525.
First fixed AsyncOS releases are 15.5.5-014 and 16.5.0-780. For release 16.0 Cisco gives no fixed build and says to migrate to a fixed release. Cisco strongly recommends that customers on releases earlier than 16.5 migrate to 16.5.0-780. NVD's CPE match covers AsyncOS 15.0 before 15.5.5-014 and 16.0 before 16.5.0-780, while Cisco's own data on the same record also lists 13.x and 14.x builds as affected.
The fix also ships in the Content Scanner Tools package, version 25.3.0.5525 and later, for all licensed and supported AsyncOS releases. That update needs no software upgrade and no restart. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected. For Cisco Secure Email Cloud Gateway the fixed package is already deployed, so no update is needed. Cisco has contacted Cloud customers where it found signs of possible compromise and advises them to renew credentials and keys.
Cisco publishes advisory cisco-sa-esa-afw-zqYJkjxp, rates the flaw Critical with CVSS 9.8, offers no workaround and says its PSIRT became aware of active exploitation.
The NVD record is published. CISA adds CVE-2026-76519 to the Known Exploited Vulnerabilities catalog and its entry on the NVD record marks exploitation as active, automatable as yes and technical impact as total.
The CISA due date for US federal agencies to apply the mitigations.
In the web interface open Mail Policies, then Incoming Mail Policies or Outgoing Mail Policies, then Advanced Malware Protection. Pick a policy and see whether Enable File Reputation is ticked. Then run contentscannerstatus at the command line and read the Content Scanner Tools version.
If the version is earlier than 25.3.0.5525, run contentscannerupdate at the command line, or turn on automatic updates under Security Services, then Service Updates. No restart is needed. Cisco says no workaround exists, so this update or a fixed release is the fix.
Cisco names 15.5.5-014 and 16.5.0-780 as first fixed releases and advises anyone on a release earlier than 16.5 to migrate to 16.5.0-780.
Run grep "System Security" system_logs on every device, including each cluster member. Cisco lists three messages: suspected compromise indicator found, security scan did not complete, and no compromise indicator found. Root access can hide traces, so also check network and firewall logs outside the device for unexpected uploads from it to outside addresses.
Save forensic data first, because an upgrade destroys logs. For a virtual appliance Cisco advises a new virtual machine on a fixed release, a configuration rebuilt without importing old files, and renewed credentials and keys. Restore every member of a cluster that holds a compromised appliance. For a physical appliance, contact Cisco TAC and keep remote access enabled.
Cisco advises keeping the appliance off the internet, or limiting access to trusted hosts.
Cisco advises putting mail and management on separate network interfaces.
Cisco advises sending logs to an external server, because an attacker with root can hide evidence on the device.
Cisco advises turning off HTTP for the admin portal.
It is a critical arbitrary file write in the Advanced Malware Protection feature of Cisco Secure Email Gateway. A crafted email attachment could let an unauthenticated attacker write files and run commands as root. It is rated CVSS 9.8.
Yes. Cisco says its PSIRT became aware of active exploitation in October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 14 October 2026. CISA lists use in ransomware campaigns as unknown.
No. Cisco says no workaround addresses this flaw. Update Content Scanner Tools to 25.3.0.5525 or later, or upgrade to a fixed AsyncOS release.
Not to close this flaw. The Content Scanner Tools update contains the fix and needs no upgrade or restart. Cisco still strongly recommends upgrading to a fixed release, and advises moving releases earlier than 16.5 to 16.5.0-780.
Cisco lists two conditions: File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525. An appliance that does not meet both is not listed as vulnerable.
It is a different flaw in the same product line. CVE-2026-76461 is an SQL injection in AsyncOS that CISA added to the catalog on 14 September 2026. Each has its own Cisco advisory, so check that your appliance is covered for both.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
