Cisco Secure Email Gateway CVE-2026-76519 (CVSS 9.8): unauthenticated AMP File Reputation path traversal writes files and runs root commands via crafted email; Cisco PSIRT confirms active exploitation in October 2026

Cisco published cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519 (CWE-23) in the Advanced Malware Protection File Reputation path of Cisco Secure Email Gateway (physical and virtual). An unauthenticated remote attacker can send a crafted attachment through an affected gateway and, when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525, write arbitrary files and execute commands as root on the underlying AsyncOS host. Cisco rates it Critical (CVSS 3.1 9.8) with no workarounds, says its PSIRT became aware of active exploitation in October 2026, and notes the issue was found in internal scanning. Fixed builds include AsyncOS 15.5.5-014 and 16.5.0-780; the Content Scanner Tools package 25.3.0.5525 or later also delivers the fix without a full software upgrade or restart. Admins should check contentscannerstatus, grep system_logs for "System Security" compromise indicators, and cross-check firewall and network logs because root access can erase evidence. Secure Email and Web Manager and Secure Web Appliance are not affected. This is a separate actively exploited SEG flaw from September's CVE-2026-76461 SQL injection (already on the desk and in CISA KEV). CISA also added CVE-2026-76519 itself to the Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies. Wires on 14–15 Oct: BleepingComputer, The Hacker News and SecurityWeek.

Product

Cisco Secure Email Gateway (AsyncOS; AMP File Reputation / Content Scanner Tools)

Versions

Vulnerable when File Reputation is enabled on a mail policy and Content Scanner Tools < 25.3.0.5525 on a vulnerable AsyncOS train. Fixed: AsyncOS 15.5.5-014, 16.5.0-780 (migrate earlier trains to 16.5.0-780); or Content Scanner Tools ≥ 25.3.0.5525. Not affected: Secure Email and Web Manager, Secure Web Appliance.

CVSS

9.8 (Cisco, CVSS 3.1 Critical)

Exploited in Australia?

unknown

Patch to

Upgrade to AsyncOS 15.5.5-014 or 16.5.0-780, or install Content Scanner Tools 25.3.0.5525 or later. Confirm with contentscannerstatus; grep system_logs for System Security compromise messages; if compromise is indicated, contact Cisco TAC and follow the advisory Recommendations.

Primary: Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp — Secure Email Gateway Arbitrary File Write (CVE-2026-76519, 14 Oct 2026) · Vendor: Cisco PSIRT advisory (CVSS 9.8, fixed AsyncOS and Content Scanner Tools builds, IoCs) · CVE: CVE-2026-76519, CVE-2026-76461 · BleepingComputer — Cisco patches actively exploited Secure Email Gateway zero-day (14 Oct 2026); also The Hacker News

vulnerabilities network