CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)
Cisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content Scanner Tools update
Defender actions
- Run contentscannerstatus on every Cisco Secure Email Gateway that has File Reputation enabled in a mail policy and update Content Scanner Tools to 25.3.0.5525 or later with contentscannerupdate wherever automatic updates are off; the update needs no restart.
- On every such gateway, and on each member of a cluster, run grep "System Security" system_logs now: on a suspected-compromise message keep the forensic data before upgrading, then follow Cisco's recovery steps (a new virtual machine on a fixed release with a fresh configuration and renewed credentials for a virtual appliance, Cisco TAC for a physical one) for every member of that cluster.
Analysis
Cisco's advisory of 2026-10-14 describes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway: improper handling of email attachments when the file reputation service is enabled lets an unauthenticated remote attacker who sends a crafted attachment through the device write arbitrary files on the underlying operating system and run commands as root, and Cisco rates it CVSS 3.1 9.8 (Cisco PSIRT, 2026-10-14). Cisco states that in October 2026 its PSIRT became aware of active exploitation, and that it has directly contacted Cisco Secure Email Cloud customers on whose devices indicators of possible compromise were identified (Cisco PSIRT, 2026-10-14); CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Cisco gives no workaround; the fix is distributed through the Content Scanner Tools package for every supported AsyncOS release and needs no software upgrade or restart, and it is also in AsyncOS 15.5.5-014 and 16.5.0-780, while release 16.0 must migrate to a fixed release (Cisco PSIRT, 2026-10-14). It is the second exploited root-level flaw in this product in about four weeks: BleepingComputer notes that last month Cisco warned of CVE-2026-76461, which also lets unauthenticated remote attackers run commands as root (BleepingComputer, 2026-10-14).
Cited evidence
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
There are no workarounds that address this vulnerability.
Content Scanner Tools versions 25.3.0.5525 and later contain the fix for this vulnerability.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.