CVE-2026-76519: Cisco Secure Email Gateway Path Traversal Is Being Exploited - Update and Check for Compromise

On October 14, 2026, Cisco published advisory cisco-sa-esa-afw-zqYJkjxp regarding a critical vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. If the File Reputation service is enabled, the gateway incorrectly processes email attachments: An unauthenticated attacker can use an email with a crafted attachment to write arbitrary files to the underlying operating system and execute commands with root privileges. The vulnerability is identified as CVE-2026-76519 and has a CVSS score of 9.8. Cisco learned of active exploitation in October 2026; the U.S. agency CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026. It is fixed in Content Scanner Tools version 25.3.0.5525 and later, and in AsyncOS 15.5.5-014 and 16.5.0-780; according to Cisco, no workaround is available.

Key points at a glance

Affected versions and updates

According to Cisco, an appliance is vulnerable only if both conditions apply: File Reputation is enabled and assigned to a Mail Policy, and the installed Content Scanner Tools are older than 25.3.0.5525. Cisco distributes the fix through the Content Scanner Tools package for all licensed and supported AsyncOS versions; Cisco also lists fixed AsyncOS versions.

For systems running an AsyncOS version earlier than 16.5, Cisco recommends migrating to 16.5.0-780. Cisco had already listed the same AsyncOS versions as fixed in the hardening advisory cisco-sa-hardening-esa-dfCrfXkm on September 14, 2026; on October 14, 2026, that advisory was supplemented with a reference stating that a path traversal vulnerability (CWE-23) covered by it is actively being exploited. Anyone who already updated to 15.5.5-014 or 16.5.0-780 following CVE-2026-76461 in September is therefore on a version Cisco considers fixed. According to the advisory, Cisco Secure Email Cloud Gateway customers do not need to take action because Cisco has already deployed the fixed Content Scanner Tools there.

The CLI displays the installed AsyncOS version with:

version

It displays the Content Scanner Tools version with:

contentscannerstatus

Cisco gives Content Scanner Tools 25.2.0.5427.15.5.001 Never updated as an example of vulnerable output. Whether File Reputation is enabled can be checked in the web interface under Mail Policies > Incoming Mail Policies or Outgoing Mail Policies, under Advanced Malware Protection: For each policy, check whether Enable File Reputation is enabled.

What is known about the exploitation

Cisco writes in the advisory that Cisco PSIRT learned of active exploitation in October 2026. According to the advisory, the vulnerability was discovered during an internal Cisco security test. Secure Email Cloud customers on whose appliances Cisco identified possible indicators of compromise were contacted directly; Cisco states that it is working on remediation and recovery there.

Neither Cisco nor CISA provide information on the attacker, the number of affected organizations, or the exact start of the attacks (as of October 15, 2026). CISA lists whether the vulnerability is used in ransomware campaigns as unknown in the KEV entry. CISA requires U.S. federal agencies to apply the vendor’s mitigations, perform forensic triage, and assess internet exposure by October 17, 2026; if no remediation is available, the product must be taken out of service.

The attack vector is normal mail flow: The email with the crafted attachment only needs to pass through the gateway. Restricting the management interface from the internet therefore does not prevent exploitation.

Immediate actions

1. Inventory systems: Determine the AsyncOS version with version, the Content Scanner version with contentscannerstatus, and the File Reputation status in all Mail Policies. For clusters, this applies to every member.

2. Check for compromise before updating (see the next section) and preserve forensic data. Cisco notes that upgrading a compromised virtual instance destroys forensic data and logs.

3. Update Content Scanner Tools: The fix is included starting with version 25.3.0.5525, and according to Cisco, no restart is required. The CLI can manually trigger the update with:

   contentscannerupdate

   Automatic updates can be enabled in the web interface under Security Services > Service Updates via Edit Update Settings; the change must then be applied with Commit. Then verify the version with contentscannerstatus.

4. Update AsyncOS: to 15.5.5-014 or 16.5.0-780; according to Cisco, systems on 16.0 and earlier must migrate to 16.5.0-780.

5. Reduce exposure: Cisco lists general hardening measures in the advisory, including preventing internet access, placing management and mail traffic on separate interfaces, disabling unneeded services such as HTTP and FTP, using strong authentication (SAML or LDAP), changing default passwords, and sending logs to an external server. These measures reduce the attack surface but do not close the vulnerability in mail flow. Cisco does not list disabling File Reputation as a workaround.

6. Monitor the advisory: Cisco will update the advisory as new information becomes available; the revision history is at the end of the advisory.

Checking for compromise

Cisco recommends checking the system logs on the appliance with the following command:

grep "System Security" system_logs

Cisco classifies the possible messages as follows:

If the appliance is part of a cluster, Cisco says the logs of every cluster member must be checked. A result without hits is not proof of a clean system: An attacker with root privileges can remove or hide traces on the appliance. Cisco therefore recommends correlating network and firewall logs outside the appliance, particularly for suspicious uploads from the gateway to external IP addresses and downloads from external IP addresses. Cisco does not name specific IP addresses, file names, or hash values in the advisory.

An update does not remove changes already made by an attacker. In case of suspected compromise, Cisco recommends the following depending on deployment:

1. Physical appliances: Contact Cisco TAC and leave remote access enabled on the affected appliances so that the investigation can proceed more quickly.

2. Virtual appliances: First preserve forensic information according to your incident policies, deploy a new virtual machine with a fixed version, rebuild the configuration without importing previous configuration files, rotate credentials and all cryptographic materials, and continue monitoring the system for anomalies.

3. Clusters: Cluster members authenticate with each other using SSH key pairs. Private keys can be extracted from a compromised appliance, which may enable access to additional cluster members. Cisco recommends restoring every member of a cluster with at least one compromised appliance to a secure configuration.

4. Secure Email Cloud: According to Cisco, contacted customers should rotate credentials and cryptographic materials.

Assessment

Affected organizations are those operating Cisco Secure Email Gateway with File Reputation enabled as a mail gateway in front of their mail server. Because the attack occurs through incoming mail flow, any such installation that accepts email from external sources and still uses older Content Scanner Tools is vulnerable. The gateway processes all messages for an organization and holds credentials and key material; command execution as root gives an attacker access to both. According to BleepingComputer, Shadowserver lists just under 300 internet-accessible Cisco Secure Email Gateway instances.

CVE-2026-76519 is the second exploited vulnerability in Cisco Secure Email Gateway within one month: In September, CVE-2026-76461 affected the email processing of AsyncOS (CVE-2026-76461: Cisco Secure Email Gateway SQL Injection). According to BleepingComputer, the AsyncOS vulnerability CVE-2025-20393 has also been exploited since November 2025 and was patched in January. The Canadian Centre for Cyber Security warned about CVE-2026-76519 in AV26-1042 on October 14, 2026.