Cisco Secure Email Gateway Critical File Write and RCE

Severity: CRITICAL · Category: Email Security / RCE · Status: Patch available; exploitation reported. CVE-2026-76519 is rated CVSS v3.1 9.8. Published 14 October 2026; reviewed 23 October 2026.

Urgent action

Confirm the scanner update or fixed AsyncOS release is installed on every affected gateway. Cisco reports active exploitation and no workaround. Investigate exposed appliances, including every cluster member, before assuming patching has restored trust. [1, 2]

Incident summary

Cisco disclosed CVE-2026-76519 on 14 October 2026. Improper attachment handling in the Advanced Malware Protection (AMP) feature can permit unauthenticated arbitrary file writes and root-level command execution. Exploitation involves a crafted email passing through a vulnerable gateway. [1, 2]

Exposure requires a vulnerable AsyncOS release, File Reputation enabled in a mail policy, and Content Scanner Tools below 25.3.0.5525. Both physical and virtual Secure Email Gateway appliances can be affected. [1]

Potential impact

• Appliance compromise: Arbitrary file writes can lead to commands running with root privileges. [1, 2]
• Cluster exposure: Stolen inter-appliance SSH keys may permit access to additional cluster members. [2]
• Reduced forensic visibility: An attacker with root access may hide or remove evidence; a clean local log result does not conclusively exclude compromise. [1, 2]

Priority actions for customers

1. Confirm configuration and ownership

Inventory gateways and clusters. Record the AsyncOS release, scanner package and File Reputation policy state. Include externally managed appliances and identify the responsible provider.

2. Apply and verify the fix

Check Content Scanner Tools with contentscannerstatus. Where required, use contentscannerupdate or the supported fixed AsyncOS release. The scanner update requires neither an AsyncOS upgrade nor a restart; verify its installation rather than assuming automatic updates succeeded. [1]

3. Investigate each cluster member

Review System Security entries in system_logs and correlate findings with independent firewall and network logs. Preserve evidence and contact Cisco TAC for suspected compromise or an incomplete security scan. [2]

4. Recover compromised appliances safely

Follow Cisco’s platform-specific recovery guidance. For virtual appliances, preserve evidence before rebuilding, avoid importing an untrusted configuration and renew exposed credentials and cryptographic material. Assess all members of a compromised cluster. [1]

Technical information

• Identifier / weakness: CVE-2026-76519; relative path traversal in AMP attachment processing. [2]
• Severity / access: Critical, CVSS v3.1 9.8; no attacker login required under the affected configuration. [1, 2]
• Exploitation status: Cisco PSIRT reports active exploitation in October 2026. [1]
• Detection focus: Local security-scan messages, unexpected outbound traffic and suspicious appliance changes; corroborate results with external telemetry. [2]

Patched versions and exposure

• Content Scanner Tools: 25.3.0.5525 or later includes the fix on licensed, supported AsyncOS releases.
• AsyncOS 15.5: fixed in 15.5.5-014. AsyncOS 16.5: fixed in 16.5.0-780. AsyncOS 16.0: migrate to a fixed release. [1, 2]
• Cisco Secure Email Cloud Gateway: Cisco has deployed the scanner fix; follow any separate customer-specific recovery notification.
• Secure Email and Web Manager and Secure Web Appliance: Cisco lists these products as not affected by this vulnerability. [1, 2]

Validation checklist

Advisory basis

Independent 443 Labs customer awareness guidance. Publication date follows Cisco’s 14 October disclosure; sources were reviewed on 23 October 2026. Applicability depends on the deployed configuration. This advisory does not establish compromise of any recipient.