plaincve:~$

// threat brief

CVE-2026-76519Actively exploited

Cisco Secure Email Gateway AMP arbitrary file write: one email attachment may give an attacker root

CVSS
9.8 CRITICAL
CISA KEV
2026-10-14
Weakness
CWE-23
Topics
Infrastructure

PlainCVE Team · Published 2026-10-17 · AI-assisted · Press brief ↓

AI review 2026-10-17 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

A crafted email attachment can let an unauthenticated attacker run root commands on Cisco Secure Email Gateway. Exploited in the wild.

Who is affectedPhysical or virtual Cisco Secure Email Gateway appliances running a vulnerable AsyncOS release where both conditions hold: the File Reputation service is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525.
What happensWith no account and no click from any recipient, an attacker may write arbitrary files on the gateway's underlying operating system, run commands with the highest privileges (root), and possibly erase traces of the intrusion.
What to do nowUpdate Content Scanner Tools to 25.3.0.5525 or later right away (no upgrade or restart needed), and plan an AsyncOS upgrade to a fixed release (Cisco recommends moving anything before 16.5 to 16.5.0-780). There are no workarounds.
Affected versionsPhysical and virtual appliances running a vulnerable AsyncOS release with the File Reputation service enabled and assigned, and Content Scanner Tools older than 25.3.0.5525. The CVE record lists 23 AsyncOS builds (13.0.0-392 through 16.0.4-016); unlisted builds have status "unknown".
Fixed versionsContent Scanner Tools 25.3.0.5525 or later; AsyncOS 15.5.5-014 for the 15.5 branch and 16.5.0-780 for the 16.5 branch; no fixed build for 16.0, migration required (all per Cisco's advisory).
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-10-14
CISA KEVListed (2026-10-14): attacks have been seen in the wild

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check whether you meet the affected conditions

    You are affected only if all three hold: a vulnerable AsyncOS release, File Reputation enabled and assigned to a mail policy, and Content Scanner Tools older than 25.3.0.5525. Builds outside the 23 listed in the CVE record are "unknown", not "unaffected", so don't relax just because your build isn't listed.

    Step 2
  2. 02Check system_logs for exploitation attempts

    Cisco's advisory gives a check that searches system_logs for "System Security" messages (use the exact command in the advisory) to confirm attempted exploitation. Run it on every cluster member and cross-check with network and firewall logs kept off the device.

    Step 4Step 5
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Update Content Scanner Tools to 25.3.0.5525 or later

    Cisco says the fix is also delivered to all licensed, supported AsyncOS releases as a Content Scanner Tools update, with no software upgrade or restart. This is the fastest route.

    Step 2Step 3
  2. 02Upgrade AsyncOS to a fixed release

    Cisco's fixed-release table: 15.5.5-014 for the 15.5 branch, 16.5.0-780 for 16.5, and no fixed build for 16.0 (migrate to a fixed release). Cisco strongly recommends moving releases before 16.5 to 16.5.0-780. The Hacker News adds that 16.0.4-302 does not fix this flaw. Cisco says there are no workarounds.

    Step 3
  3. 03Cloud customers: no action needed to get the fix, but contacted customers still need to act

    Per Cisco, Secure Email Cloud Gateway customers don't have to do anything to receive the fix. Cisco's investigation did turn up indicators of possible compromise on some cloud devices, and Cisco reached out to those owners directly. For contacted customers, Cisco's advice is to get the device back to a secure state where possible, by replacing credentials and any cryptographic material on the appliance, and to lock down who can reach the appliance with strong access controls.

RESPONDRespondIf you find signs of compromise
  1. 01If you suspect exploitation, preserve evidence first and don't just update

    For virtual appliances, Cisco lays out an order. Start by saving forensic data as your own incident-handling policy requires, since upgrading an instance that is already compromised wipes out its logs and forensic evidence. After that, stand up a new VM on a fixed release, set the configuration up from scratch rather than importing old config files, replace the credentials and all cryptographic material that were on the appliance, and keep watching for unusual behavior. Cisco says to contact TAC when a restore can't be done, and to contact TAC for any physical appliance you suspect was exploited.

    Step 4Step 5
  2. 02If one cluster member is compromised, restore every member

    Cisco explains that cluster members use SSH key pairs to prove their identity to one another, so an attacker on one compromised appliance could obtain those private keys and turn them against the other members. Its strong recommendation is therefore to bring every member of such a cluster back to a secure configuration, not only the one that was hit.

    Step 4Step 5
  3. 03Clean on-device logs don't prove you are safe

    Cisco warns attackers may remove or hide evidence and strongly recommends cross-checking network and firewall logs outside the device. PlainCVE's suggestion: if you find signs, treat the device as possibly fully compromised and don't assume applying the fix makes it safe; rebuild a compromised device using Cisco's steps above.

    Step 4Step 5
HARDENHardenPrevent the next one
  1. 01Keep logs off the device

    Cisco advises cross-checking with off-device network and firewall logs; routinely shipping gateway-related logs to another system makes them hard to tamper with even if an attacker gets root.

    Step 5
  2. 02Don't wait only for dedicated advisories

    According to The Hacker News, this flaw was fixed in a September hardening release before it got its own advisory in October. Applying Content Scanner Tools and AsyncOS updates routinely gets you protected earlier.

Full remediation steps and notes

Cisco says there are no workarounds; updating is the only fix.

ItemFixed versionSource
Content Scanner Tools25.3.0.5525 or later (no upgrade or restart)Cisco
AsyncOS 16.516.5.0-780Cisco
AsyncOS before 16.5Cisco strongly recommends migrating to 16.5.0-780Cisco
AsyncOS 15.515.5.5-014Cisco
AsyncOS 16.0No fixed build, migrate to a fixed releaseCisco
AsyncOS 16.0.4-302 (the September SQL injection fix)Does not fix this flawThe Hacker News

Suggested order: update Content Scanner Tools first, since it’s fastest and doesn’t interrupt service, then schedule the AsyncOS upgrade. To check for exploitation, use the exact system_logs command from Cisco’s advisory on every cluster member. Because attackers may delete evidence, a clean result on the device doesn’t prove you’re safe. Always cross-check with network and firewall logs kept off the device.

If you suspect exploitation, don’t just update. Cisco’s advisory says upgrading a compromised instance will destroy forensic data and logs. For virtual appliances, preserve forensic information first, then deploy a new VM running a fixed release, rebuild the configuration without importing old configuration files, renew credentials and cryptographic material installed on the appliance, and keep monitoring. If any cluster member is compromised, restore every member (the private SSH keys used between members may have been exposed). For physical appliances, or if restoring isn’t possible, contact Cisco TAC.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Cisco Secure Email Gateway AMP arbitrary file write: one email attachment may give an attacker root: 1. The attacker sends an email with a crafted attachment → 2. The gateway's AMP File Reputation service processes the attachment → 3. The attachment is mishandled and a file is written where it shouldn't be → 4. The attacker runs commands as root → 5. The attacker may remove or hide evidenceCVE-2026-76519 · Cisco Secure Email Gateway AMP arbitrary file write: one email attachment may give anattacker rootAttackerYour systemThe attacker sends an email with a crafted attachment — No account is needed, and no recipient has to open or click anything; the email only has to pass through an affected gateway. 1The attacker sendsan email with acrafted attachmentThe gateway's AMP File Reputation service processes the attachment — The flawed handling is reached only if File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. 2The gateway's AMPFile Reputationservice processesthe attachmentThe attachment is mishandled and a file is written where it shouldn't be — CISA classifies it as relative path traversal (CWE-23): the write location is not kept inside the intended folder. 3The attachment ismishandled and afile is writtenwhere it shouldn'…The attacker runs commands as root — Cisco says a successful exploit can run commands as root on the underlying OS; our analysis is that this amounts to full control of the gateway. 4The attacker runscommands as rootThe attacker may remove or hide evidence — Cisco warns that with this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise. 5The attacker mayremove or hideevidenceAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-76519-cisco-secure-email-file-write · CC BY 4.0
Cisco Secure Email Gateway AMP arbitrary file write: one email attachment may give an attacker root: 1. The attacker sends an email with a crafted attachment → 2. The gateway's AMP File Reputation service processes the attachment → 3. The attachment is mishandled and a file is written where it shouldn't be → 4. The attacker runs commands as root → 5. The attacker may remove or hide evidenceCVE-2026-76519 · Cisco Secure EmailGateway AMP arbitrary file write: oneemail attachment may give an attackerrootThe attacker sends an email with a crafted attachment — No account is needed, and no recipient has to open or click anything; the email only has to pass through an affected gateway. 1AttackerThe attacker sends an emailwith a crafted attachmentThe gateway's AMP File Reputation service processes the attachment — The flawed handling is reached only if File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. 2Your systemThe gateway's AMP FileReputation service processesthe attachmentThe attachment is mishandled and a file is written where it shouldn't be — CISA classifies it as relative path traversal (CWE-23): the write location is not kept inside the intended folder. 3Your systemThe attachment is mishandledand a file is written where itshouldn't beThe attacker runs commands as root — Cisco says a successful exploit can run commands as root on the underlying OS; our analysis is that this amounts to full control of the gateway. 4AttackerThe attacker runs commands asrootThe attacker may remove or hide evidence — Cisco warns that with this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise. 5AttackerThe attacker may remove or hideevidenceAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-76519-cisco-secure-email-file-write
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker sends an email with a crafted attachment

    No account is needed, and no recipient has to open or click anything; the email only has to pass through an affected gateway.

    Defense: Cisco says there are no workarounds; only the fix stops this.

  2. Your system

    The gateway's AMP File Reputation service processes the attachment

    The flawed handling is reached only if File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525.

    Defense: Update Content Scanner Tools to 25.3.0.5525 or later; no upgrade or restart required.

  3. Your system

    The attachment is mishandled and a file is written where it shouldn't be

    CISA classifies it as relative path traversal (CWE-23): the write location is not kept inside the intended folder.

    Defense: Upgrade AsyncOS to a fixed release (for example 16.5.0-780).

  4. Attacker

    The attacker runs commands as root

    Cisco says a successful exploit can run commands as root on the underlying OS; our analysis is that this amounts to full control of the gateway.

    Defense: Check system_logs for "System Security" messages as Cisco describes, to spot exploitation attempts.

  5. Attacker

    The attacker may remove or hide evidence

    Cisco warns that with this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise.

    Defense: Cross-check with network and firewall logs kept off the device.

Who is affected

ConditionAffected?
Physical or virtual Secure Email Gateway + vulnerable AsyncOS + File Reputation enabled and assigned to a mail policy + Content Scanner Tools older than 25.3.0.5525Affected
Content Scanner Tools 25.3.0.5525 or laterCisco says this contains the fix
File Reputation not enabled, or not assigned to a mail policyDoes not meet Cisco’s listed conditions
Secure Email Cloud GatewayCisco says customers need take no action to get the fix; Cisco did detect malicious activity on some cloud devices and contacted those owners, and strongly recommends contacted customers renew credentials and cryptographic material on the appliance when possible and restrict access to it
Secure Email and Web Manager, Secure Web ApplianceCisco’s advisory confirms not affected

Cisco’s advisory points readers to its Fixed Software section to identify vulnerable AsyncOS releases. Per that section’s table, 15.5 builds earlier than 15.5.5-014, the whole 16.0 branch (Cisco says “migrate to a fixed release”), and 16.5 builds earlier than 16.5.0-780 are in the affected range (the two conditions above must still both hold). The CVE record filed by Cisco as CNA lists 23 affected builds, from 13.0.0-392 through 16.0.4-016. Unlisted builds have the status “unknown”, which does not mean unaffected. NVD’s CPE ranges start at 15.0 (15.0 up to but excluding 15.5.5-014, and 16.0 up to but excluding 16.5.0-780), while Cisco’s CNA record also lists 13.x and 14.x builds such as 13.0.0-392 through 14.3.0-032 as affected; this page follows Cisco’s data, so appliances on 13.x or 14.x should be checked too.

How it works

Cisco Secure Email Gateway is a filtering appliance that sits in front of a company’s mail servers. Its AMP (Advanced Malware Protection) feature includes a “File Reputation” service that checks whether email attachments are known malicious files.

Cisco says the problem is improper handling of email attachments when File Reputation is enabled. If an attacker gets an email with a crafted attachment through the gateway, they may be able to write arbitrary files on the underlying operating system and run commands as root (the system’s highest privilege). No account is needed, and no recipient has to do anything (RedLegg notes no user interaction is required). Cisco also warns that an attacker with this access may remove or hide evidence. Our analysis: running commands as root amounts to full control of the gateway, which matches the “high” confidentiality, integrity and availability ratings in the CVSS score.

CISA classifies it as CWE-23 (relative path traversal). Cisco has not published code details; the snippets below are a generic illustration of this weakness type, not Cisco’s code.

The flawed approach (conceptual illustration):

Show code example(python)
# Join the name that came with the attachment straight onto the scan folder
path = os.path.join(SCAN_DIR, attachment_name)
write(path, data)

The fixed approach (conceptual illustration):

Show code example(python)
path = os.path.realpath(os.path.join(SCAN_DIR, attachment_name))
# Make sure the final location is still inside the intended folder; otherwise refuse
if not path.startswith(os.path.realpath(SCAN_DIR) + os.sep):
    raise ValueError("refusing to write")
write(path, data)

Timeline

DateEvent
2026-08-19CVE ID reserved
2026-09-14Cisco publishes hardening advisory cisco-sa-hardening-esa-dfCrfXkm (v1.0), grouping internally found bugs into umbrella CVEs by weakness class (path traversal: CVE-2026-76440), with fixed builds 15.5.5-014 and 16.5.0-780 (the same builds this flaw’s advisory lists as fixed); that advisory does not mention AMP or File Reputation. The Hacker News reports Cisco now says these builds covered this flaw
2026-10According to the CVE record, Cisco PSIRT becomes aware of active exploitation
2026-10-14Cisco publishes its advisory (16:00 GMT), the CVE is published, and CISA adds it to KEV
2026-10-17KEV remediation deadline for US federal agencies

Further reading

  • Scoring: Cisco gives a CVSS 3.1 score of 9.8 (Critical). As of 2026-10-17, NVD’s status is “Analyzed”, and the CVSS score NVD shows is Cisco’s 9.8.
  • Sources disagree on “zero-day”: BleepingComputer calls it an actively exploited zero-day, while The Hacker News reports the fix had shipped since September 14 and Cisco only learned of attacks in October. No source shows attacks began before a patch existed.
  • When attacks began, how many devices were hit and who is behind them are not public; The Hacker News notes the advisory doesn’t say whether attackers actually got root anywhere. CISA lists known ransomware use as “Unknown”.
  • BleepingComputer cites Shadowserver tracking nearly 300 internet-exposed instances; how many are vulnerable or are honeypots is unknown.
  • Cisco found the flaw internally (CVE record); its Cisco bug ID is CSCwu56223.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-17 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisoryCisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp) · Cisco, 2026-10-14 · accessed 2026-10-15
  2. AdvisoryCisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 (cisco-sa-hardening-esa-dfCrfXkm) · Cisco, 2026-09-14 · accessed 2026-10-15
  3. CVE / NVD / OSVCVE-2026-76519 CVE record (JSON) · CVE Program, 2026-10-14 · accessed 2026-10-15
  4. CVE / NVD / OSVNVD API - CVE-2026-76519 · NIST · accessed 2026-10-15
  5. ResearchSecurity Bulletin: Arbitrary File Write Vulnerability in Cisco Secure Email Gateway Advanced Malware Protection · RedLegg · accessed 2026-10-15
  6. NewsCisco patches actively exploited Secure Email Gateway zero-day · BleepingComputer · accessed 2026-10-15
  7. NewsCisco warns of active attacks · The Hacker News · accessed 2026-10-15

Press brief

In one sentence

Cisco Secure Email Gateway is an appliance companies use to filter incoming and outgoing email. A flaw in how its AMP malware-protection feature handles attachments could let an unauthenticated attacker write arbitrary files and run commands as root, simply by getting a crafted email through the gateway. Cisco published its advisory on October 14, 2026, and the US agency CISA added it to its Known Exploited Vulnerabilities catalog the same day. Cisco has released updates and says there are no workarounds.

Key facts

Severity
CVSS 3.1 9.8 (Cisco) sec.cloudapps.cisco.com
Cisco advisory published
2026-10-14 (cisco-sa-esa-afw-zqYJkjxp) sec.cloudapps.cisco.com
Fix
Content Scanner Tools 25.3.0.5525+; AsyncOS 16.5.0-780 sec.cloudapps.cisco.com
Active exploitation
Cisco PSIRT became aware in October 2026 (CVE record) cveawg.mitre.org

Confirmed

  • Cisco confirms that mishandled attachments in the AMP File Reputation service can let an unauthenticated remote attacker write arbitrary files and run commands as root.
  • The CVE record (from Cisco) says Cisco PSIRT learned of active exploitation in October 2026; CISA added it to KEV on 2026-10-14.
  • Cisco detected malicious activity on some Secure Email Cloud devices and contacted those customers directly.
  • Cisco says there are no workarounds.

Unconfirmed / disputed

  • Sources disagree on "zero-day": BleepingComputer uses the label, while The Hacker News reports the fix had shipped since September 14; no source shows attacks began before a patch existed.
  • When attacks began, how many devices were hit and who is behind them are not public; the advisory also doesn't say whether attackers actually got root on any device.
  • Shadowserver tracks nearly 300 internet-exposed instances, but how many are vulnerable or are honeypots is unknown.
  • CISA lists known ransomware use as "Unknown".

Quotable line

The gateway's job is to inspect dangerous attachments; this time, the inspection itself became the way in.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Cisco Secure Email Gateway AMP arbitrary file write: one email attachment may give an attacker root". PlainCVE. https://plaincve.date/en/vulns/cve-2026-76519-cisco-secure-email-file-write (accessed YYYY-MM-DD)
BibTeX
@misc{cve202676519ciscosecureemailfilewrite2026,
  title  = {Cisco Secure Email Gateway AMP arbitrary file write: one email attachment may give an attacker root},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-76519-cisco-secure-email-file-write},
  note   = {Updated 2026-10-17}
}