Cisco has warned that attackers are exploiting a critical vulnerability in Cisco Secure Email Gateway that lets an unauthenticated remote attacker compromise the appliance by sending it an email. The flaw, CVE-2026-76519, carries a CVSS 3.1 base score of 9.8 and sits in the Advanced Malware Protection (AMP) feature. According to Cisco's advisory and the NVD record, an email containing a crafted attachment, processed by a device with the file reputation service enabled, can let the attacker write arbitrary files to the underlying operating system and execute commands with root privileges. The CVSS vector rates the attack as requiring no privileges and no user interaction.

Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on October 14, 2026 at 16:00 GMT. It states that in October 2026 the Cisco Product Security Incident Response Team (PSIRT) became aware of active exploitation, and that the vulnerability was found during internal security scanning. The advisory lists no workarounds. The US Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities (KEV) catalog the same day with a federal remediation due date of October 17, 2026. That deadline (October 17, 2026) has passed.

What Is Vulnerable

Cisco says physical and virtual appliances are affected when both of these conditions are true:

  • File Reputation (part of AMP) is enabled and assigned to an incoming or outgoing mail policy, and
  • Content Scanner Tools is a version earlier than 25.3.0.5525. Cisco says administrators can check the installed version with the contentscannerstatus CLI command.

CISA's KEV entry names the flaw the "Cisco Secure Email Gateway Relative Path Traversal Vulnerability." Cisco classifies the weakness as CWE-23 (relative path traversal) and tracks it as bug ID CSCwu56223. The full vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, and high impact to confidentiality, integrity and availability.

Cisco says two related products are not affected: Secure Email and Web Manager, and Secure Web Appliance.

The vulnerable component is the attachment-scanning path itself. A gateway exists to receive untrusted mail from the internet, and here the compromise happens while the appliance inspects the attachment, before any recipient interaction.

Fixed Releases

Cisco's advisory lists these remediation paths:

  • AsyncOS 15.5: first fixed release 15.5.5-014.
  • AsyncOS 16.0: "migrate to a fixed release."
  • AsyncOS 16.5: first fixed release 16.5.0-780.
  • Content Scanner Tools: 25.3.0.5525 or later contains the fix for all licensed and supported releases. Cisco says this update requires neither a software upgrade nor a product restart, and appliances with automatic updates enabled need no action.

Cisco strongly recommends that customers on releases earlier than 16.5 move to 16.5.0-780. For Secure Email Cloud Gateway, the advisory says no customer action is required because Cisco has taken steps to protect the infrastructure.

Timeline

  • September 14, 2026 (Cisco): Fixes ship in AsyncOS 15.5.5-014 and 16.5.0-780. According to SecurityWeek, Cisco grouped the flaw at the time under the identifier CVE-2026-76440.
  • October 2026 (Cisco): Cisco PSIRT becomes aware of active exploitation of CVE-2026-76519 by unidentified attackers.
  • October 14, 2026 (Cisco, CISA): Cisco publishes advisory cisco-sa-esa-afw-zqYJkjxp (version 1.0, Final), including a compromise check. CISA adds the CVE to KEV.
  • October 17, 2026 (CISA): KEV remediation due date for federal civilian agencies.

SecurityWeek reported on October 15 that Cisco has contacted owners of Secure Email Cloud devices where indicators of possible compromise were found, and that Cisco says it is "engaged in remediation and recovery operations." SecurityWeek also reported that this is the second Secure Email Gateway vulnerability exploited in the wild since mid-September; the first was CVE-2026-76461, another unauthenticated flaw that enables root-level command execution.

Neither Cisco, CISA nor SecurityWeek has named a threat actor, and CISA lists known ransomware campaign use as unknown.

What It Means for Defenders

With no workaround available, response is a sequence of identify, preserve, update and investigate:

  1. Find exposed appliances. Inventory every Secure Email Gateway, including virtual instances and cluster members, and check each against the two affected-product conditions. Confirm whether automatic Content Scanner Tools updates are actually enabled and have applied, rather than assuming so.
  2. Preserve evidence before upgrading a suspect device. Cisco warns that upgrading a compromised virtual instance destroys forensic data and logs. CISA's KEV entry flags this CVE for forensic triage under Binding Operational Directive 26-04.
  3. Run Cisco's compromise check on every device. The advisory's check searches each appliance's system logs, and in clusters every member must be checked. Cisco says to contact TAC if a suspected indicator is found or the scan does not complete.
  4. Use logs from outside the appliance. Because an attacker with root can hide or remove evidence, Cisco recommends reviewing network and firewall logs for unexpected uploads to, or downloads from, external IP addresses. Forwarding appliance logs to an external server going forward makes this kind of review possible next time.
  5. Rebuild rather than patch compromised instances. For virtual appliances, Cisco advises deploying a new VM on a fixed release, rebuilding the configuration without importing old configuration files, renewing credentials and cryptographic material, and continuing to monitor. Cisco says every member of a cluster containing a compromised appliance should be restored, because SSH keys shared between members may be exposed. For physical appliances, Cisco says to contact TAC and keep remote access enabled to support the investigation.
  6. Reduce the management attack surface. Cisco's hardening guidance includes separating mail and management interfaces, filtering management traffic, disabling HTTP and FTP, using strong authentication, and changing default passwords.
  7. Close out CVE-2026-76461 as well. Organizations that addressed the earlier flaw should verify that remediation and any associated compromise review are complete, since both bugs affect the same appliances.

Sources