Cisco Secure Email Gateway CVE-2026-76519: Patch Now, CISA Warns

Cisco has confirmed that attackers are actively exploiting a critical, unauthenticated file-write flaw in Secure Email Gateway's malware-scanning engine, and both Cisco and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) want it patched immediately. The bug, tracked as CVE-2026-76519, carries a maximum-severity CVSS score of 9.8 and can let a remote attacker who sends nothing more than a crafted email attachment write arbitrary files — and potentially run commands as root — on the appliance that scanned it.

What is CVE-2026-76519?

CVE-2026-76519 is a relative path traversal vulnerability (CWE-23) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, the appliance-based successor to Cisco's Email Security Appliance (ESA) that scans inbound and outbound mail for malware, spam, and policy violations. Cisco published its advisory — cisco-sa-esa-afw-zqYJkjxp — on October 14, 2026, at 16:00 GMT, rating the flaw Critical with a CVSS 3.1 base score of 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). That vector means the bug requires no authentication, no special access conditions, and no action from a victim beyond having mail flow through a vulnerable gateway.

According to Cisco's own description, the flaw stems from improper handling of email attachments when the File Reputation service processes them. By crafting a malicious attachment, a remote, unauthenticated attacker can write files to arbitrary locations on the underlying operating system of the appliance. Depending on where those files land, that can escalate to executing commands with root privileges — full control of the box.

Crucially, this is a different vulnerability from the Cisco Secure Email Gateway and Identity Services Engine flaws pandromeda.com covered on September 29 — CVE-2026-76460 and CVE-2026-76461. Those were an ISE authentication bypass and a Secure Email Gateway SQL-injection bug. CVE-2026-76519 is a separate file-write/remote-code-execution flaw in the AMP scanning pipeline, disclosed roughly two weeks later. It's at least the second Secure Email Gateway security scare in a month, and part of a broader run of Cisco advisories across the gateway, SD-WAN, and ISE product lines this year — pandromeda.com also covered a Catalyst SD-WAN Manager flaw patched earlier in October.

How the attack works

Secure Email Gateway's AMP integration exists to catch malware hiding in email attachments before it reaches a mailbox: incoming messages get handed to a File Reputation lookup, and attachments can be routed through a local content-scanning component (Content Scanner Tools) for deeper analysis. CVE-2026-76519 lives in how that scanning pipeline handles the attachment on disk.

Because the flaw is a relative path traversal issue, an attacker can craft file paths inside or alongside an attachment that break out of the directory the scanner expects to write into. The practical effect, per Cisco, is that "an unauthenticated, remote attacker" can "write arbitrary files on the underlying operating system" of the gateway — and from there, potentially execute commands as root. No user has to open the attachment, click a link, or do anything at all; simply having File Reputation scan the inbound mail is enough to trigger the vulnerable code path. That "zero interaction" quality is what pushes the CVSS score to the maximum of 9.8 and is exactly the kind of bug that's attractive to attackers looking for a foothold inside a corporate mail-filtering chokepoint — a box that, by design, sits in the path of every message and often has elevated trust on the internal network.

Cisco's advisory notes it became aware the flaw was being actively exploited in October 2026, after the issue was originally found through internal security scanning. Cisco has not published a count of how many appliances were hit or attributed the activity to a specific actor, and pandromeda.com has not independently verified exploitation beyond Cisco's own statement — treat any claims about scale or actor attribution you see elsewhere as unconfirmed unless Cisco or CISA says otherwise.

Who is affected

Two conditions both have to be true for a gateway to be exposed:

• The File Reputation service is enabled and assigned to at least one mail policy, and
• The device's Content Scanner Tools package is older than version 25.3.0.5525 (Cisco's advisory gives 25.2.0.5427.15.5.001 as an example of a vulnerable version string).

This affects Cisco Secure Email Gateway in both physical-appliance and virtual-appliance form, running AsyncOS. Cisco's advisory states that Secure Email and Web Manager and Secure Web Appliance are not affected by this particular CVE. Customers running the hosted Secure Email Cloud Gateway service don't need to do anything — Cisco says it has already deployed the fixed scanner package to that cloud service on customers' behalf.

CISA's KEV listing and the federal deadline

CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog on October 14, 2026 — the same day Cisco's advisory went out — citing evidence of active exploitation. The catalog entry lists it as a "Cisco Secure Email Gateway Relative Path Traversal Vulnerability" and directs agencies to apply Cisco's mitigations in line with Binding Operational Directive 22-01/26-04, or to stop using the product if no fix can be applied.

Because CVE-2026-76519 has no workaround — only a patch — the KEV catalog's listed due date was October 17, 2026, just three days after disclosure, for U.S. federal civilian executive branch (FCEB) agencies to remediate. That short runway reflects both the severity (unauthenticated root-level compromise) and the fact that fixed software had, in Cisco's telling, already been available since mid-September — before exploitation was confirmed — so there was no reason for a longer grace period. Private-sector organizations aren't bound by the KEV deadline, but CISA's KEV catalog is widely treated as a de facto "patch this first" list across the security industry, and Secure Email Gateway's internet-facing role makes it a reasonable candidate for the same urgency outside government.

The NVD record

The National Vulnerability Database's entry for CVE-2026-76519 mirrors Cisco's own numbers: a CVSS 3.1 base score of 9.8 and CWE-23 (Relative Path Traversal) as the underlying weakness class, attributed to Cisco's own PSIRT as the scoring CNA. The NVD description describes the same mechanism — a flaw in AMP's handling of email attachments, triggered when File Reputation is enabled, that can let an unauthenticated remote attacker write arbitrary files to the underlying operating system.

How to check if you're affected

Administrators of an on-premises or virtual Secure Email Gateway should:

1. Confirm whether File Reputation is enabled and assigned to any mail policy (Mail Policies > File Reputation and Analysis in the web UI, or the equivalent CLI configuration).
2. Check the installed Content Scanner Tools version from the CLI with the contentscannerstatus command.
3. Compare that version against 25.3.0.5525 — anything older is vulnerable if File Reputation is active.
4. Note the AsyncOS release the appliance is running, since that determines which upgrade path applies.

How to patch it

Cisco's advisory lays out two separate but related fixes:

• Content Scanner Tools update (the core fix): Update to version 25.3.0.5525 or later using the contentscannerupdate CLI command. Cisco says this can be applied without a full software upgrade and without rebooting the appliance, which removes the usual excuse for delaying it.
• AsyncOS upgrade (recommended for full currency): Customers on the 15.5 train should move to 15.5.5-014; customers on 16.5 should move to 16.5.0-780. There is no fixed build within the 16.0 train — Cisco's guidance for 16.0 (and any earlier) deployments is to migrate to 16.5.0-780 rather than wait for a 16.0 patch.

There is no workaround. Cisco's advisory is explicit that disabling File Reputation is not listed as an official mitigation, so the only way to close the hole is to install the fixed Content Scanner Tools package (and, ideally, bring AsyncOS current at the same time).

Checking for signs of compromise

Because successful exploitation can hand an attacker root access to the appliance, Cisco's guidance includes checking system logs for indicators of compromise rather than assuming a device is clean just because it's now patched. A root-level attacker who has already gotten in could, in theory, tamper with or delete logs, so administrators should treat log review as one signal among several, not a guarantee. Cisco's recommended first pass is to search system logs for entries related to "System Security" (for example, with a command like grep "System Security" system_logs on the appliance), alongside normal incident-response hygiene: looking for unexpected files, unfamiliar scheduled jobs, modified configuration, and unusual outbound connections. Because compromised gateways can also be used to reach the private SSH keys shared between clustered appliances, organizations running Secure Email Gateway in a cluster should pay particular attention to key material if they suspect a device was exploited before patching.

Why this matters beyond the patch note

Secure Email Gateway appliances are deliberately positioned where every inbound message passes through them, which is exactly what makes a zero-click, unauthenticated RCE bug in their scanning engine so dangerous: an attacker doesn't need an employee to make a mistake, just an address to send mail to. A compromised gateway can be used to read, modify, or redirect mail flow; pivot further into the network; or simply serve as a persistent foothold. CVE-2026-76519 is also a reminder that "defense" tooling — the AMP scanner meant to catch malicious attachments — can itself become the attack surface, something worth keeping in mind the next time a vendor pitches a new inline scanning feature as a pure security win. For broader context on how attachment-based attacks are typically defanged on the client side, see pandromeda.com's explainer on Mark of the Web, a complementary (and separate) layer of defense that doesn't depend on gateway scanning at all.

This also arrives in a month already dominated by patching news — from October's unusually large Patch Tuesday to a steady drumbeat of edge-device CVEs — and underscores a pattern security teams have been living with all year: internet-facing appliances from major vendors, including Cisco's own ISE and SD-WAN products, keep turning up as the entry point in KEV-listed, actively exploited bugs.

What to do next

If you operate Cisco Secure Email Gateway on-premises or as a virtual appliance, treat this as a same-week task, not a maintenance-window nice-to-have:

• Run contentscannerstatus now to check your Content Scanner Tools version.
• Apply the Content Scanner Tools update to 25.3.0.5525+ immediately — it doesn't require a reboot, so there's little reason to wait.
• Schedule the AsyncOS upgrade to 15.5.5-014 or 16.5.0-780 (or migrate off 16.0 to 16.5.0-780) as soon as a maintenance window allows.
• Review system logs for exploitation indicators before and after patching, especially on internet-facing or clustered gateways.
• If you're a U.S. federal civilian agency, confirm remediation against CISA's KEV deadline and reporting requirements; everyone else should still prioritize this given the CVSS 9.8 rating and confirmed in-the-wild exploitation.
• Secure Email Cloud Gateway customers can confirm with Cisco that the fix has already been applied to their hosted instance, but otherwise don't need to take action.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage