CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Secure Email Gateway AMP file-reputation path traversal: one crafted attachment writes files and runs commands as root, exploited in the wild and CISA KEV-listed (CVSS 9.8); fixed by Content Scanner Tools 25.3.0.5525 or later, AsyncOS 15.5.5-014 and 16.5.0-780 (2026-10-14)

cve · CVE-2026-76519

Coverage
1
first 2026-10-15 → last 2026-10-15
Latest activity
2026-10-15
Cisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content Scanner Tools…
Peak priority
critical
1 critical
Targets
public-sector
sectors: public-sector, technology
Sources cited
3
3 hosts

Action items (3)

Do-now tasks recorded on the entries about CVE-2026-76519, newest first. Check the date before acting on an older one.

  • Immediate action: An unauthenticated attacker who sends one crafted attachment through a gateway with File Reputation enabled gets root, Cisco confirms exploitation, and no workaround exists. Update Content Scanner Tools (no restart) on every gateway that has automatic updates disabled, then check system_logs on every cluster member for Cisco's "System Security" messages; Cisco strongly recommends restoring a compromised appliance and every member of its cluster, because the cluster's SSH private keys could be accessed.
    2026-10-15CVE-2026-76519
  • Run contentscannerstatus on every Cisco Secure Email Gateway that has File Reputation enabled in a mail policy and update Content Scanner Tools to 25.3.0.5525 or later with contentscannerupdate wherever automatic updates are off; the update needs no restart.
    2026-10-15CVE-2026-76519
  • On every such gateway, and on each member of a cluster, run grep "System Security" system_logs now: on a suspected-compromise message keep the forensic data before upgrading, then follow Cisco's recovery steps (a new virtual machine on a fixed release with a fresh configuration and renewed credentials for a virtual appliance, Cisco TAC for a physical one) for every member of that cluster.
    2026-10-15CVE-2026-76519

Defender insights

What each entry about CVE-2026-76519 tells a defender to do, newest first.

2026-10-15CRITICALexploitedCisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content Scanner Tools update

Exposure · detection

Story timeline

  1. 2026-10-15CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)
    trending-vulnerabilitiesCisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content Scanner Tools update

Hunting pivots

Affected products
Cisco AsyncOSCisco Secure Email Gateway
Tags
actively-exploitedcisa-kevpatch-availablepath-traversalpre-authrcevulnerabilitieszero-click
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-15/cve-2026-76519-cisco-secure-email-gateway-file-write-root · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-10-15/cve-2026-76519-cisco-secure-email-gateway-file-write-root · ATT&CK page ↗

Entries about Cisco Secure Email Gateway AMP file-reputation path traversal: one crafted attachment writes files and runs commands as root, exploited in the wild and CISA KEV-listed (CVSS 9.8); fixed by Content Scanner Tools 25.3.0.5525 or later, AsyncOS 15.5.5-014 and 16.5.0-780 (2026-10-14) (1)

2026-10-15 · view entry permalink →

CRITICALCVE-2026-76519exploitedNATOA2

CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)

Cisco's advisory of 2026-10-14 describes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway: improper handling of email attachments when the file reputation service is enabled lets an unauthenticated remote attacker who sends a crafted attachment through the device write arbitrary files on the underlying operating system and run commands as root, and Cisco rates it CVSS 3.1 9.8 (Cisco PSIRT, 2026-10-14). Cisco states that in October 2026 its PSIRT became aware of active exploitation, and that it has directly contacted Cisco Secure Email Cloud customers on whose devices indicators of possible compromise were identified (Cisco PSIRT, 2026-10-14); CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Cisco gives no workaround; the fix is distributed through the Content Scanner Tools package for every supported AsyncOS release and needs no software upgrade or restart, and it is also in AsyncOS 15.5.5-014 and 16.5.0-780, while release 16.0 must migrate to a fixed release (Cisco PSIRT, 2026-10-14). It is the second exploited root-level flaw in this product in about four weeks: BleepingComputer notes that last month Cisco warned of CVE-2026-76461, which also lets unauthenticated remote attackers run commands as root (BleepingComputer, 2026-10-14).

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

There are no workarounds that address this vulnerability.

Content Scanner Tools versions 25.3.0.5525 and later contain the fix for this vulnerability.

Cisco PSIRT 2026-10-14

Builds on: Cisco's mail gateway can be rooted by a single crafted email, and Cisco found out from a real…

vulnerability15 Oct 03:40Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · BleepingComputer · CISA

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • cisa.gov1 (33%)
  • sec.cloudapps.cisco.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)