Cisco Secure Email Gateway Arbitrary File Write Vulnerability - CVE-2026-76519

Cisco Secure Email Gateway CVE-2026-76519 CWE-23 CVSS 9.8 Active Exploitation

Overview

Cisco disclosed active exploitation of a critical vulnerability in Cisco Secure Email Gateway appliances.

A remote attacker can send a specially crafted email attachment through a vulnerable gateway without authentication. Successful exploitation may enable arbitrary file writes and subsequent command execution with root privileges.

Technical Details

• CVE: CVE-2026-76519
• CWE: CWE-23 (Relative Path Traversal)
• CVSS: 9.8 (Critical)
• Affected component: Advanced Malware Protection (AMP), specifically attachment-processing logic

Required conditions reported by Cisco advisory context:

• File Reputation is enabled and assigned to a mail policy
• Content Scanner Tools version is earlier than 25.3.0.5525

Affected products:

• Physical and virtual Cisco Secure Email Gateway appliances running vulnerable AsyncOS releases

Technical Specifications

Attribute	Details
CVE	CVE-2026-76519
Weakness	Relative Path Traversal (CWE-23)
Severity	CVSS 9.8 (Critical)
Attack Prerequisite	Specially crafted email attachment processed by vulnerable AMP path
Authentication Requirement	None (remote unauthenticated delivery through email flow)
Potential Privilege Outcome	Arbitrary file write with potential root-level command execution

Affected Products

• Cisco Secure Email Gateway physical appliances on vulnerable AsyncOS and scanner versions.
• Cisco Secure Email Gateway virtual appliances on vulnerable AsyncOS and scanner versions.
• Deployments with File Reputation/AMP attachment processing enabled in active mail policy paths.

Attack Scenario

1. Attacker crafts a malicious email attachment targeting vulnerable AMP attachment handling.
2. Email is sent through a reachable vulnerable Cisco Secure Email Gateway path.
3. Gateway processes attachment using affected scanner/components.
4. Path traversal condition enables unauthorized arbitrary file write.
5. Follow-on exploitation may execute commands with root privileges.
6. Compromised node can be leveraged for persistence, policy tampering, or lateral movement to other cluster members.

Impact Assessment

Primary ImpactOperational ImpactExposure Context

• Unauthorized access risk to email-security gateway infrastructure
• Arbitrary file-write capability on affected appliances
• Potential root-level command execution on compromised nodes

• Potential disruption of email filtering and security workflows
• Risk of data exposure/manipulation in mail processing context
• Cluster-wide risk if additional members are reachable and similarly vulnerable

• Active exploitation status increases urgency for patching and validation across all cluster members

Mitigation Strategies

1. Update Content Scanner Tools to version 25.3.0.5525 or later.
2. Upgrade AsyncOS to fixed releases such as 15.5.5-014 or 16.5.0-780 where applicable.
3. Run contentscannerstatus to verify installed scanner version.

4. Review system logs with:

   • grep "System Security" system_logs

5. Investigate suspicious network and appliance behavior across all cluster members.

6. Validate consistency of updates and indicators across every node in clustered deployments.

Resources and References

Public Reporting

• Cisco Warns of Exploited Secure Email Gateway Vulnerability - SecurityWeek
• Cisco make-me-root email bug exploited as a 0-day by unknown crims
• Cisco Secure Email Gateway Arbitrary File Write Vulnerability
• Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

---

Last Updated: October 15, 2026