Cisco has disclosed CVE-2026-76519, a critical (CVSS 9.8) flaw in Cisco Secure Email Gateway that lets an unauthenticated attacker write arbitrary files and run commands as root just by sending a crafted email attachment through the appliance. Cisco confirms active exploitation, there is no workaround, and the fastest fix is a Content Scanner Tools update that doesn't need a reboot.
What happened
Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on October 14, 2026. The bug is a relative path traversal (CWE-23) in the Advanced Malware Protection feature. It affects physical and virtual Secure Email Gateway appliances only when both of these are true:
- The File Reputation service is enabled and assigned to a mail policy.
- Content Scanner Tools is older than 25.3.0.5525.
Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected. Content Scanner Tools 25.3.0.5525 or later fixes the issue on all supported releases. The fixed AsyncOS releases are:
| AsyncOS release | First fixed release |
|---|---|
| 15.5 | 15.5.5-014 |
| 16.0 | Migrate to a fixed release |
| 16.5 | 16.5.0-780 |
Cisco confirmed exploitation in October 2026. The Hacker News reports that Cisco found the flaw internally and contacted managed service customers whose appliances showed signs of compromise. For cloud customers, Cisco says it has already deployed mitigations and is contacting affected customers directly. CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog on October 14. BleepingComputer lists earlier Secure Email Gateway flaws, including a maximum-severity bug exploited in zero-day attacks since November 2025 and an AsyncOS email-parsing flaw patched in September 2026 that also allowed unauthenticated root command execution.
Why it matters
The attack needs no login and no user click, and the bug sits in the feature that scans attachments for malware. The gateway sits in front of every mailbox and handles password reset links, MFA enrollment messages and invoices. Root on that box means an attacker can read or change that traffic and get a foothold next to your mail and directory infrastructure.
Cisco's recovery guidance also puts identity work on the list. For compromised virtual appliances it says to renew all credentials and cryptographic material, and to restore every cluster member that may share SSH keys. Cisco warns that root access lets attackers remove evidence, so a clean log check doesn't fully prove the appliance is clean. Any admin accounts, LDAP bind accounts, TLS keys and SSH keys tied to an exposed gateway should be treated as possibly exposed.
What to check in your environment
- Inventory every Secure Email Gateway, physical and virtual, including clustered and MSP-managed units, and record the AsyncOS release of each.
- Check whether File Reputation is on. Cisco's advisory points to Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection and the "Enable File Reputation" checkbox. Check both incoming and outgoing policies.
- Check the Content Scanner Tools version with the CLI command
contentscannerstatus. Anything below 25.3.0.5525 is vulnerable when File Reputation is enabled. - Update Content Scanner Tools now. Cisco lists
contentscannerupdatefor a manual update; no restart is required. Then plan the AsyncOS upgrade to 15.5.5-014 or 16.5.0-780, and move any 16.0 appliances to a fixed release. - Run Cisco's compromise check:
grep "System Security" system_logs. "Suspected compromise indicator was found" means compromise; "Security scan did not complete" means contact Cisco TAC; "No compromise indicator was found" means none detected. - If an appliance is compromised, open a TAC case for physical units. For virtual units, Cisco says to preserve forensic evidence, deploy a new VM on fixed software, rebuild the configuration without importing old files, and renew all credentials and cryptographic material.
- Reduce exposure per Cisco's hardening list: separate mail and management interfaces, restrict management to trusted hosts, use SAML or LDAP for authentication, disable HTTP on the admin portal, and send logs to an external server.
References
- Cisco Security Advisory: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
- CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog
- The Hacker News: Cisco warns of active attacks on Secure Email Gateway
- BleepingComputer: Cisco patches actively exploited Secure Email Gateway zero-day