---
schema: 1
kind: vulnerability
title: "CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)"
headline: "Cisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content Scanner Tools update"
summary: >
  Cisco's advisory of 2026-10-14 fixes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection (file reputation) path of Cisco Secure Email Gateway
  that lets an unauthenticated attacker who sends one crafted attachment through the device write files and run commands as root (CVSS 9.8); Cisco says its PSIRT became aware
  of exploitation in October 2026, and CISA listed the flaw in KEV the same day. Only gateways with File Reputation enabled on a mail policy and Content Scanner Tools earlier
  than 25.3.0.5525 are exposed; there is no workaround, and the fix ships as a Content Scanner Tools update that needs no restart or upgrade, and in AsyncOS 15.5.5-014 and 16.5.0-780.
discovered_at: "2026-10-15T03:40:00Z"
updated_at: null
event_date: "2026-10-14"
run_id: 2026-10-15T0256Z-intel
priority: critical
immediate_action:
  title: "Verify Content Scanner Tools 25.3.0.5525 or later on every Cisco Secure Email Gateway and run Cisco's compromise check today"
  action: >
    An unauthenticated attacker who sends one crafted attachment through a gateway with File Reputation enabled gets root, Cisco confirms exploitation, and no workaround exists.
    Update Content Scanner Tools (no restart) on every gateway that has automatic updates disabled, then check system_logs on every cluster member for Cisco's "System Security"
    messages; Cisco strongly recommends restoring a compromised appliance and every member of its cluster, because the cluster's SSH private keys could be accessed.
tags: [vulnerabilities, actively-exploited, pre-auth, rce, path-traversal, zero-click, cisa-kev, patch-available]
regions: [global]
sectors: [public-sector, technology]
entities: ["product:cisco-secure-email-gateway", "product:cisco-asyncos"]
techniques: [T1190, T1059]
affected_products: ["Cisco Secure Email Gateway", "Cisco AsyncOS"]
cves:
  - id: CVE-2026-76519
    cvss: "9.8"
    epss: null
    type: path-traversal
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Cisco Secure Email Gateway (physical and virtual) with the File Reputation service enabled and assigned to a mail policy and Content Scanner Tools earlier than 25.3.0.5525"
    fixed: "Content Scanner Tools 25.3.0.5525 or later (no software upgrade or restart); AsyncOS 15.5.5-014 (15.5), 16.5.0-780 (16.5); 16.0 must migrate to a fixed release; no workaround"
sources:
  - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"
    publisher: "Cisco PSIRT"
    date: "2026-10-14"
    role: primary
  - url: "https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/"
    publisher: "BleepingComputer"
    date: "2026-10-14"
    role: corroborating
  - url: "https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog"
    publisher: "CISA"
    date: "2026-10-14"
    role: corroborating
closed_sources: []
evidence:
  - quote: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
    publisher: "Cisco PSIRT"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"
  - quote: "There are no workarounds that address this vulnerability."
    publisher: "Cisco PSIRT"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"
  - quote: "Content Scanner Tools versions 25.3.0.5525 and later contain the fix for this vulnerability."
    publisher: "Cisco PSIRT"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"
verification: multi-source
sourcing_note: >
  The exploitation facts, the exposure conditions and the fixed builds come from Cisco's own advisory; BleepingComputer restates it and CISA's alert confirms the KEV listing.
  No source names an actor, a victim, a victim count or when exploitation began.
confidence: high
references:
  - 2026-09-15/cve-2026-76461-cisco-secure-email-gateway-sqli-root-rce
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Run contentscannerstatus on every Cisco Secure Email Gateway that has File Reputation enabled in a mail policy and update Content Scanner Tools to 25.3.0.5525 or later with contentscannerupdate wherever automatic updates are off; the update needs no restart."
  - "On every such gateway, and on each member of a cluster, run grep \"System Security\" system_logs now: on a suspected-compromise message keep the forensic data before upgrading, then follow Cisco's recovery steps (a new virtual machine on a fixed release with a fresh configuration and renewed credentials for a virtual appliance, Cisco TAC for a physical one) for every member of that cluster."
updates: []
migrated_from: null
---

Cisco's advisory of 2026-10-14 describes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway: improper handling of email attachments when the file reputation service is enabled lets an unauthenticated remote attacker who sends a crafted attachment through the device write arbitrary files on the underlying operating system and run commands as root, and Cisco rates it CVSS 3.1 9.8 ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)). Cisco states that in October 2026 its PSIRT became aware of active exploitation, and that it has directly contacted Cisco Secure Email Cloud customers on whose devices indicators of possible compromise were identified ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)); CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day ([CISA, 2026-10-14](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)). Cisco gives no workaround; the fix is distributed through the Content Scanner Tools package for every supported AsyncOS release and needs no software upgrade or restart, and it is also in AsyncOS 15.5.5-014 and 16.5.0-780, while release 16.0 must migrate to a fixed release ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)). It is the second exploited root-level flaw in this product in about four weeks: BleepingComputer notes that last month Cisco warned of CVE-2026-76461, which also lets unauthenticated remote attackers run commands as root ([BleepingComputer, 2026-10-14](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/)).

**Exposure:** a physical or virtual Cisco Secure Email Gateway is exposed when both conditions hold: the File Reputation service is enabled and assigned to a mail policy (web interface, Mail Policies, Incoming or Outgoing Mail Policies, Advanced Malware Protection, "Enable File Reputation" ticked), and the Content Scanner Tools version, shown by the `contentscannerstatus` command, is earlier than 25.3.0.5525; Secure Email and Web Manager and Secure Web Appliance are not affected, and Cisco Secure Email Cloud Gateway customers need take no action ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)). The attack arrives as an email attachment passing through the appliance, so exposure does not depend on its management interface being reachable ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)).

**Detection:** start with the appliance's own logs: Cisco's self-check is `grep "System Security" system_logs` on each cluster member, which returns "Suspected compromise indicator was found", "Security scan did not complete" or "No compromise indicator was found" ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)). Cisco warns that an attacker with root may remove or hide evidence, so it also recommends cross-checking network and firewall logs outside the device for unexpected uploads from the appliance to external addresses or downloads from malicious addresses ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)); that is egress telemetry from the gateway's own addresses.

**Defender takeaway:** confirm Content Scanner Tools 25.3.0.5525 or later on every gateway today, since automatic updates deliver it and only gateways with updates disabled need the manual update, and run the log check on every one; for a virtual appliance with a compromise indicator, Cisco says to keep forensic data before upgrading, because upgrading a compromised instance destroys it, then deploy a new virtual machine on a fixed release, rebuild the configuration without importing an old file and renew credentials and cryptographic material (a physical appliance goes to Cisco TAC), and strongly recommends restoring every member of a cluster that contains a compromised appliance, since the cluster's SSH private keys could be accessed ([Cisco PSIRT, 2026-10-14](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)).