Cisco ESA / SMA
Cisco Secure Email Gateway (ESA) and Secure Email and Web Manager (SMA): administration, certificates, and operating the AsyncOS-based mail security appliances.
NewCVE-2026-76519: Cisco Secure Email Gateway Path Traversal Is Being Exploited - Update and Check for Compromise
A crafted email attachment is all it takes: Through a path traversal vulnerability in the AMP File Reputation feature, attackers can write arbitrary files to Cisco Secure Email Gateway and execute commands with root privileges (CVE-2026-76519, CVSS 9.8). The vulnerability is being exploited. Updating the Content Scanner Tools or AsyncOS and checking for compromise are required.
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Is Being Exploited—Update and Check for Compromise
A specially crafted email is all it takes: via an SQL injection in AsyncOS, attackers can execute commands with root privileges on Cisco Secure Email Gateway (CVE-2026-76461, CVSS 9.8). The vulnerability is being exploited, and no workaround is available. Updating to a fixed version and checking for compromise are required.
Renewing a Certificate on the Cisco SMA
Certificates can only be installed on the Cisco SMA through the CLI, and current AsyncOS versions validate the entire chain during import: without a stored root CA, the import fails. This article shows the paths to a new key pair, the OpenSSL approach in detail, how to handle OpenSSL 3's RC2-40-CBC error, and how to import the internal root CA into the appliance's trust store.
