Cisco Secure Email Gateway

CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)

Cisco's advisory of 2026-10-14 describes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway: improper handling of email attachments when the file reputation service is enabled lets an unauthenticated remote attacker who sends a crafted attachment through the device write arbitrary files on the underlying operating system and run commands as root, and Cisco rates it CVSS 3.1 9.8 (Cisco PSIRT, 2026-10-14). Cisco states that in October 2026 its PSIRT became aware of active exploitation, and that it has directly contacted Cisco Secure Email Cloud customers on whose devices indicators of possible compromise were identified (Cisco PSIRT, 2026-10-14); CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Cisco gives no workaround; the fix is distributed through the Content Scanner Tools package for every supported AsyncOS release and needs no software upgrade or restart, and it is also in AsyncOS 15.5.5-014 and 16.5.0-780, while release 16.0 must migrate to a fixed release (Cisco PSIRT, 2026-10-14). It is the second exploited root-level flaw in this product in about four weeks: BleepingComputer notes that last month Cisco warned of CVE-2026-76461, which also lets unauthenticated remote attackers run commands as root (BleepingComputer, 2026-10-14).

Builds on: Cisco's mail gateway can be rooted by a single crafted email, and Cisco found out from a real…

CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)

Cisco's own advisory names the mechanism plainly: insufficient validation in the email-parsing logic of AsyncOS lets an unauthenticated remote attacker send a single crafted email containing SQL statements through the device, and "a successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system" (Cisco PSIRT, 2026-09-14). CVE-2026-76461 (CVSS 9.8) affects every Cisco Secure Email Gateway, physical and virtual, regardless of configuration; Cisco confirms Secure Email and Web Manager and Secure Web Appliance are not affected by this specific flaw. There is no workaround; the only remediation is upgrading to AsyncOS 15.5.5-014, 16.0.4-302, or 16.5.0-780, the release Cisco "strongly recommends" migrating to.

Two details in Cisco's own wording raise this above a routine emergency patch. First, Cisco states the vulnerability "was found during the resolution of a Cisco TAC support case" (meaning it surfaced from a real customer's compromise investigation, not internal fuzzing), and that it has already directly contacted Secure Email Cloud customers on whose devices indicators of compromise were found, having upgraded all Cloud instances itself (Cisco PSIRT, 2026-09-14). Second, CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, giving it a three-day remediation deadline (due 2026-09-17) and flagging it for Forensic Triage Requirements (CISA KEV, catalogue version 2026.09.14); NCSC-NL's own advisory relays the same exploitation claim: "Cisco reports that successful exploitation of this vulnerability has been observed" (translated from Dutch) (NCSC-NL, NCSC-2026-0368, 2026-09-14). Because a successful exploit grants root, Cisco itself warns that local log evidence of exploitation may have been removed by the attacker, and recommends cross-checking firewall and network logs external to the appliance rather than relying on the device's own logs alone.

The same day, Cisco shipped a companion "Security Hardening Release" advisory for the identical product line, bundling five further internally-discovered vulnerabilities that Cisco groups by CWE class rather than by individual flaw: a path-traversal grouping (CVE-2026-76440, CVSS 9.8), an improper-access-control grouping (CVE-2026-76441, CVSS 9.8), an uncontrolled-resource-consumption grouping (CVE-2026-20353, CVSS 9.8), a second injection-class grouping (CVE-2026-76443, CVSS 9.8, explicitly distinct from the exploited CVE-2026-76461 despite sharing the same top-level weakness class) and an input-validation grouping (CVE-2026-76442, CVSS 7.5). Cisco's own table states that "the CVSS score that is assigned to each CVE ID represents the maximum potential severity of the single most impactful underlying vulnerability within that specific CWE category," so the four identical 9.8 scores reflect an assigned ceiling per grouping rather than four independently-confirmed critical bugs. Unlike the exploited flaw, this bundle also affects Secure Email and Web Manager, and Cisco states none of the five is known to be exploited or publicly disclosed elsewhere. Notably, Cisco attributes discovery of this bundle to "internal security testing using existing testing processes as well as frontier AI models" (Cisco PSIRT, hardening-release advisory, 2026-09-14). Administrators who upgrade against the exploited CVE close all six CVEs with the same action, since both advisories share identical fixed releases for Secure Email Gateway.