Cisco says attackers are exploiting CVE-2026-76519, a critical flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway that lets an unauthenticated attacker write files and run commands as root by sending an email with a crafted attachment.
What Cisco has disclosed
Cisco’s security advisory, first published on October 14, 2026, rates the flaw Critical with a CVSS base score of 9.8 and classifies it as CWE-23. It describes an unauthenticated, remote attacker who sends an email containing a crafted attachment through an affected device and can then write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco attributes the cause to improper handling of email attachments when the file reputation service is enabled.
On exploitation, the advisory is short and direct: “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Cisco says the flaw was found during internal security scanning, that it has bug ID CSCwu56223, and that no workarounds address it.
Which appliances are exposed
The advisory limits the exposure to physical and virtual Secure Email Gateways that meet two conditions. The File Reputation service, which is part of Cisco AMP, must be enabled and assigned to a mail policy, and the Content Scanner Tools version must be earlier than 25.3.0.5525. Cisco explains how to check both from the management interface and the command line. It lists Cisco Secure Email and Web Manager and Cisco Secure Web Appliance as confirmed not vulnerable.
Two ways to get the fix
Cisco lists fixed AsyncOS releases for the gateway. Release 15.5 is fixed in 15.5.5-014, release 16.5 is fixed in 16.5.0-780, and customers on release 16.0 are told to migrate to a fixed release. Cisco recommends that anyone running a release earlier than 16.5 move to 16.5.0-780.
The same fix also ships separately. Cisco says it is distributed to all licensed and supported AsyncOS releases through an updated Content Scanner Tools package, and that versions 25.3.0.5525 and later contain it. Updating that package needs no software upgrade and no restart. Customers who have turned on automatic Content Scanner Tools updates need to take no action once the update has applied. Customers who disabled automatic updates must run contentscannerupdate at the command line or enable automatic updates in the web interface. For Cisco Secure Email Cloud Gateway, Cisco says no action is required because a fixed version is already deployed.
How Cisco says to check for compromise
Cisco publishes indicators that administrators can read from the appliance’s system logs. Searching the logs for the string “System Security” returns one of three messages: a suspected compromise indicator was found, the security scan did not complete, or no compromise indicator was found. The first two send the administrator to Cisco’s Technical Assistance Center. On clustered appliances, the check has to run on every member.
The appliance’s own logs have a limit, and Cisco says so. With root access, attackers “may remove or hide evidence of exploitation and indicators of compromise.” Cisco recommends cross-checking network and firewall logs outside the affected device for unexpected uploads that started from the gateway to external IP addresses and for downloads from malicious IP addresses. On Secure Email Cloud, administrators without command-line access may not be able to run the check themselves, and Cisco says it has contacted directly the customers where it detected malicious activity.
If an appliance may be compromised
For a suspected physical appliance, Cisco asks customers to contact its Technical Assistance Center and to enable remote access on the device so the investigation moves faster. For a suspected virtual appliance, Cisco’s recommended sequence is to record forensics information first, because “Upgrading a compromised instance will destroy forensic data and logs.” The customer then deploys a new virtual machine running a fixed release, rebuilds the configuration without importing previous configuration files, renews credentials and cryptographic materials installed on the appliance, and keeps monitoring.
Clusters carry an added step. Cisco notes that gateways in a cluster authenticate to each other with SSH key pairs, and that the private keys could be accessed on a compromised appliance. Access to them may let an attacker compromise other cluster members, so Cisco strongly recommends restoring every member of a cluster that contains at least one compromised appliance to a secure configuration.
An out-of-cycle advisory
This advisory arrived outside the calendar Cisco has described for routine disclosures. In a post on the Cisco security blog, Cisco says it reserves the first and third Wednesday of each month for security hardened software publications, with seven days of advance notice. October 14 was the second Wednesday. The post anticipates this case. Russ Smoak, VP, Information Security at Cisco, wrote: “Emergencies will happen. Our process will remain unchanged for responding and working out of our normal release cycles to address security incidents, active exploitation and external discovery of zero-day vulnerabilities.” The post also says Cisco will assign an individual CVE when a vulnerability involves known exploitation or otherwise demands defender action, which matches the single CVE here.
What this means for the security leader
A mail gateway sits between the Internet and the mailboxes, so the email that triggers this flaw is the ordinary traffic the appliance exists to process. In our reading, the useful fact for a security leader is the delivery path of the fix. A Content Scanner Tools update ships without an upgrade or a restart, so it can reach appliances ahead of a scheduled maintenance window, and it will not reach any appliance whose owner turned automatic updates off. That makes the first task an inventory: which gateways have File Reputation enabled, and what Content Scanner Tools version each one reports.
The gateway line has a recent history on this site. In September we covered a different Secure Email Gateway flaw that allowed root code execution, and an earlier opinion piece argued for replacing an exploited edge appliance before trusting it again. Cisco’s own virtual-appliance guidance, which calls for a fresh virtual machine and a configuration rebuilt without imported files, applies that approach to this advisory.
What defenders should do
- Check each Secure Email Gateway for File Reputation enabled on a mail policy, and read the Content Scanner Tools version with the
contentscannerstatuscommand. - Bring Content Scanner Tools to 25.3.0.5525 or later, or move to a fixed AsyncOS release, and turn on automatic Content Scanner Tools updates.
- Search the system logs on every appliance and every cluster member for the “System Security” messages, and review network and firewall logs for uploads from the gateway to external addresses.
- Record forensics before any upgrade of a suspect appliance, then rebuild virtual appliances on a fixed release, renew credentials and cryptographic materials, and restore every member of an affected cluster.
- Contact Cisco’s Technical Assistance Center for a physical appliance that returns a compromise indicator or an incomplete scan.
Source: Cisco, Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
