Cisco Secure Email Gateway: a single booby-trapped email gives attackers root, flaw already exploited

Cisco has fixed CVE-2026-76519, a critical flaw in its Secure Email Gateway that lets anyone send an email with a crafted attachment to write files and run commands as root on the appliance. Cisco says it is already being exploited; CISA gave US agencies until 17 October to act.

What happened

On 14 October 2026, Cisco published an advisory for CVE-2026-76519 (CVSS 9.8), a flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, its on-premises email filtering appliance. Cisco states that its security team became aware of active exploitation in October 2026. The same day, CISA added the flaw to its catalogue of exploited vulnerabilities, with a deadline of 17 October for US federal agencies.

The bug lies in the way attachments are handled when the file reputation service is enabled. No login is needed: an attacker only has to send an email with a crafted attachment through the gateway to write arbitrary files on the underlying system and execute commands with root privileges. Cisco says there is no workaround.

Who is affected

Physical and virtual Secure Email Gateway appliances are vulnerable when two conditions are met: File Reputation is enabled in a mail policy (Mail Policies > Advanced Malware Protection), and the Content Scanner Tools package is older than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected. For the Secure Email Cloud Gateway, Cisco says it has already deployed the fix.

What to do now

1. Check the version with the CLI command contentscannerstatus. Below 25.3.0.5525, you are exposed.
2. Update the package with contentscannerupdate: no reboot or AsyncOS upgrade is needed, and appliances with automatic updates receive it on their own.
3. Plan the AsyncOS upgrade: 15.5.5-014 or 16.5.0-780. Cisco recommends moving anything older than 16.5 to 16.5.0-780.
4. Look for traces: search system_logs for System Security messages, and check your firewall and network logs for unexpected uploads from the appliance, since root access lets an attacker erase evidence locally.
5. If compromise is suspected, contact Cisco TAC for a physical appliance; rebuild a virtual one from scratch with fixed software, without importing the old configuration file, and renew credentials and keys. In a cluster, every member must be restored, as the SSH keys shared between members may have been stolen.

Our take

A mail gateway reads every message sent to the company, so it is reachable by anyone with an email address. A security component that opens attachments must be patched as quickly as a VPN, and its outbound traffic should be monitored from outside the device itself.

Sources

• Cisco — Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-76519
• The Hacker News — Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

How we choose, verify and write our analyses →