Cisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write

Summary

Cisco has disclosed CVE-2026-76519, a critical arbitrary file write vulnerability affecting Cisco Secure Email Gateway. The vulnerability carries a CVSS score of 9.8 and is associated with improper handling of email attachments when the Advanced Malware Protection (AMP) File Reputation service is enabled. An unauthenticated remote attacker could exploit the flaw by sending an email containing a specially crafted attachment, potentially writing arbitrary files to the underlying operating system and executing commands with root privileges. Cisco has confirmed active exploitation of this vulnerability. Organizations using affected appliances should verify their Content Scanner Tools version and apply the available security updates immediately.

Vulnerability Details

CVE ID	Severity	CVSS Score	Vulnerability Type
CVE-2026-76519	Critical	9.8	Relative Path Traversal / Arbitrary File Write

Technical Detail

CVE-2026-76519 is an arbitrary file write vulnerability in Cisco Secure Email Gateway associated with improper handling of email attachments by the Advanced Malware Protection (AMP) functionality. The issue involves the File Reputation service, which evaluates files and attachments as part of the email security process. When this service is enabled and assigned to a mail policy, a specially crafted email attachment may trigger the vulnerable file-handling behavior in the underlying operating system. The vulnerability is associated with relative path traversal (CWE-23), which can allow file operations to access locations outside their intended directory when path components are not handled securely.

An unauthenticated remote attacker could exploit the vulnerability by sending an email containing a maliciously crafted attachment to an affected appliance. Successful exploitation may allow the attacker to write arbitrary files to the underlying system without first authenticating to the appliance. The vulnerability affects physical and virtual Cisco Secure Email Gateway deployments running affected AsyncOS releases when the File Reputation service is enabled and assigned to a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525.

The consequences may extend beyond unauthorized file creation. Cisco states that successful exploitation could allow an attacker to execute commands with root privileges on the underlying operating system. Such access could enable extensive control over the appliance, including modifying system files, interfering with security processes, and potentially accessing information available to the compromised system. In clustered deployments, compromise may also pose a risk to other cluster members because SSH private keys used for authentication between members could be exposed.

Cisco has confirmed that this vulnerability is being actively exploited and has provided software and Content Scanner Tools updates to address the issue. Administrators should assess both the appliance's software release and its AMP/File Reputation configuration when determining exposure. Because exploitation may result in root-level access, organizations should also investigate potential compromise rather than relying solely on installing the update.

Affected Versions

According to Cisco's security advisory, an appliance is vulnerable when it is running an affected Cisco AsyncOS release and both of the following conditions are met:

• 1. The File Reputation service, which is part of AMP, is enabled and assigned to a mail policy.
• 2. The Content Scanner Tools version is earlier than 25.3.0.5525.

Product / Software Branch	Fixed Release
Cisco Secure Email Gateway — AsyncOS 15.5	15.5.5-014
Cisco Secure Email Gateway — AsyncOS 16.0	Migrate to a fixed release as directed by Cisco
Cisco Secure Email Gateway — AsyncOS 16.5	16.5.0-780

Note: Update Content Scanner Tools to version 25.3.0.5525 or later. Cisco recommends that customers running AsyncOS releases earlier than 16.5 migrate to AsyncOS 16.5.0-780.

The Content Scanner Tools update can be applied on licensed and supported AsyncOS releases without a full software upgrade or appliance restart. Administrators should consult the official Cisco security advisory to confirm the appropriate remediation for their deployment.

Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected by this vulnerability.

Indicators of Compromise

Cisco recommends checking the appliance's system logs for messages that may indicate a suspected compromise. Run the following command on each cluster member:

grep "System Security" system_logs

Log Message	Recommended Action
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.	Contact Cisco Technical Assistance Center (TAC) and follow the recommended recovery instructions.
System Security: Security scan did not complete. Contact TAC for further recommendations.	Contact Cisco TAC for assistance with investigating the appliance.
System Security: No compromise indicator was found.	No compromise indicator was detected by this check. If the appliance is vulnerable, apply the security updates regardless of the result.

Impact

• Remote root-level command execution: An unauthenticated attacker could potentially execute commands with root privileges on a vulnerable appliance.
• Arbitrary file modification: An attacker could write files to the underlying operating system, potentially altering system components or introducing malicious files.
• Appliance compromise: Successful exploitation could give an attacker extensive control over the email security gateway and its operations.
• Exposure of sensitive information: Information accessible to the compromised appliance could be at risk, depending on the attacker's access and the deployment configuration.
• Risk to clustered appliances: Cisco warns that private SSH keys used for authentication between cluster members could be accessed on a compromised appliance, potentially putting other members at risk.
• Disruption of email security: A compromised gateway could affect email inspection, filtering, and other security operations.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic ID	Tactic
T1190	Exploit Public-Facing Application	TA0001	Initial Access
T1068	Exploitation for Privilege Escalation	TA0004	Privilege Escalation

Mitigation and Recommendations

• 1. Apply security updates: Upgrade to an applicable fixed AsyncOS release and ensure Content Scanner Tools is updated to version 25.3.0.5525 or later.
• 2. Prioritize vulnerable appliances: Identify Cisco Secure Email Gateway appliances meeting the vulnerable configuration conditions and apply the appropriate security updates as soon as possible.
• 3. Investigate possible compromise: Review system logs on every cluster member and examine externally stored network and firewall logs for suspicious activity.
• 4. Follow Cisco's recovery guidance: Contact Cisco TAC if compromise is suspected and follow the recommended recovery procedures.
• 5. Preserve forensic evidence and restore affected systems: Preserve evidence before upgrading a suspected compromised virtual appliance. If a cluster member is compromised, follow Cisco's recommendation to restore all cluster members.
• 6. Strengthen security controls: Restrict appliance and management access to trusted hosts, disable unnecessary services, rotate potentially exposed credentials and cryptographic material, and monitor logs stored outside the appliance.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.