Cisco Secure Email Gateway CVE-2026-76519 (CVSS 9.8): A Single Crafted Attachment Gives Unauthenticated Attackers Root — Exploited and in CISA KEV

Critical · 2026-11-04 · By H.A

Cisco confirms active exploitation of a path-traversal file-write flaw in Secure Email Gateway's File Reputation handling that lets an unauthenticated email attachment run commands as root, with no workaround but a no-restart Content Scanner Tools fix.

Overview

Cisco has confirmed active exploitation of CVE-2026-76519, a critical (CVSS 9.8) arbitrary file write vulnerability in Cisco Secure Email Gateway. An unauthenticated remote attacker only has to send an email with a crafted attachment. When the gateway processes it, the attacker can write files to the underlying operating system and run commands as root. No recipient has to open anything, because the gateway does the parsing itself.

Cisco published the advisory (cisco-sa-esa-afw-zqYJkjxp) on 14 October 2026. There are no workarounds. CISA added the flaw to the Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies. Weeks later, on-premises appliances that have not taken the fixed Content Scanner Tools or a fixed AsyncOS build remain exposed. An email gateway is high-value: it sees every inbound message and often holds directory credentials.

The Vulnerability

• CVE: CVE-2026-76519 (CWE-23, Relative Path Traversal); Cisco bug CSCwu56223
• Score: CVSS 3.1 base 9.8, network-reachable, no privileges, no user interaction
• Component: Attachment handling in the File Reputation service of Cisco Advanced Malware Protection (AMP)
• Affected: Physical and virtual Secure Email Gateway appliances where both of these hold:
• File Reputation is enabled and assigned to an incoming or outgoing mail policy
• Content Scanner Tools is earlier than 25.3.0.5525
• Not affected: Secure Email and Web Manager, Secure Web Appliance
• Cloud: Secure Email Cloud Gateway has already been fixed by Cisco. Cisco has contacted cloud customers whose devices showed signs of possible compromise.

Cisco says the flaw was found during internal security scanning, and PSIRT became aware of exploitation in October 2026. Cisco has not described the post-exploitation activity or attributed it to an actor.

Timeline

• October 2026: Flaw found internally; exploitation observed by Cisco PSIRT.
• 14 October 2026: Advisory published; CVE-2026-76519 added to CISA KEV.
• 17 October 2026: CISA due date for federal agencies.
• November 2026: Unpatched on-premises appliances remain at risk.

Tradecraft

• Email as the delivery mechanism: Attackers need no network path to the management interface. Any mail that reaches the gateway and passes through a policy with File Reputation enabled can carry the exploit.
• Path traversal to root: The crafted attachment abuses relative path handling to write files outside the intended directory. Cisco says that leads to command execution as root.
• Hard to see after the fact: With root access, an attacker can tamper with local logs. Cisco therefore tells customers to check external firewall and network logs as well.

Indicators of Compromise

Cisco has not published network indicators or hashes. It ships an on-box check (below) that reports whether a compromise indicator was found.

Detection

Run Cisco's built-in check on every appliance, and on each cluster member:

grep "System Security" system_logs

• "Suspected compromise indicator was found": follow the advisory's recommendations and open a TAC case.
• "Security scan did not complete": contact TAC.
• "No compromise indicator was found": no compromise detected; upgrade.

Confirm exposure:

• File Reputation: Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection; check whether "Enable File Reputation" is selected for any policy.
• Content Scanner Tools version:

contentscannerstatus

Also review perimeter firewall logs for unexpected outbound connections from the gateway, such as uploads to unknown IPs or downloads of tools.

Recommended Actions

1. Update Content Scanner Tools to 25.3.0.5525 or later. This contains the fix and does not need a restart:

contentscannerupdate

Or enable automatic updates under Security Services > Service Updates.

1. Upgrade AsyncOS to a fixed release: 15.5.5-014 on the 15.5 train, or 16.5.0-780 (which Cisco recommends for anything earlier than 16.5). Release 16.0 must migrate to a fixed release.
2. There is no workaround. Disabling File Reputation takes away the vulnerable condition but also turns off a protection, so treat it only as a stopgap while you patch.
3. If an indicator is found: isolate the appliance, collect evidence with TAC, rebuild or reimage as advised, and rotate every credential the gateway stores, including LDAP bind accounts, SMTP auth and API keys.
4. Make sure email gateways can reach only the destinations they need, so a compromised appliance cannot easily send data out.

Analyst Assessment

Unauthenticated, root-level code execution delivered by ordinary email is about as serious as it gets for perimeter appliances. Exploitation is confirmed by the vendor and the flaw is in CISA's KEV catalog. The fix is a no-restart component update, so there is little reason for any on-premises gateway to still be vulnerable. Organisations that patched late should run the compromise check rather than assume they are clean, because email security appliances are a known target for espionage groups looking for long-term access.