CVE-2026-76519: Secure Email Gateway root file write via email attachment

What it is

The Advanced Malware Protection (AMP) feature in Cisco Secure Email Gateway handles email attachments badly when File Reputation is turned on (CWE-23, relative path traversal). An unauthenticated attacker sends an email with a crafted attachment through the gateway. The gateway writes attacker-chosen files to its own file system, and the attacker can run commands as root. Cisco rates it CVSS 9.8.

Cisco says its PSIRT is aware of active exploitation, and CISA added the CVE to the KEV catalog the day the advisory came out. Cisco found the bug in its own internal security scanning. There are no workarounds. A mail gateway receives untrusted mail from the internet by design, so an exposed device needs no special access to be attacked.

Am I affected?

You’re affected if both are true:

1. File Reputation (part of Cisco AMP) is enabled and assigned to a mail policy.
2. Content Scanner Tools is earlier than 25.3.0.5525.

This applies to physical and virtual Secure Email Gateways. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco Secure Email Cloud Gateway customers need no action for patching: Cisco says it applied mitigations and the fixed Content Scanner Tools is part of the standard upgrade process.

Check File Reputation (web interface):

1. Go to Mail Policies > Incoming Mail Policies > Advanced Malware Protection, or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection.
2. Select a mail policy and check whether Enable File Reputation is ticked.

Check the Content Scanner Tools version (CLI):

cisco-esa> contentscannerstatus

Cisco’s example of a vulnerable device shows 25.2.0.5427.15.5.001 with “Never updated” as the last updated value.

What to do

1. Update Content Scanner Tools to 25.3.0.5525 or later. Cisco says the fix is delivered through this component, and that no software upgrade or restart is needed. Manual update:

cisco-esa> contentscannerupdate

Expected output: “Requesting check for new Content Scanner updates.” To get this automatically, go to Security Services > Service Updates, click Edit Update Settings, tick Automatic Updates, click Submit, then Commit Changes twice (top right, then to confirm). Devices with automatic updates already on need no action, but check the version anyway.

2. Upgrade AsyncOS. Fixed releases are 15.5.5-014 and 16.5.0-780. Cisco strongly recommends moving anything earlier than 16.5 to 16.5.0-780. For 16.0, Cisco lists no fixed release and says to migrate.

3. Check whether the device was already compromised (see Detection), on every device in a cluster. Cisco says to do this before or alongside patching.

If the check finds a suspected compromise:

• Physical appliance: contact Cisco TAC and enable remote access to speed the investigation.
• Virtual appliance: preserve forensic data first, because upgrading destroys logs. Then deploy a new virtual machine on a fixed release, rebuild the configuration without importing old configuration files, and renew credentials and cryptographic material that were on the appliance.
• Clusters: SSH key pairs used between cluster members may be exposed. Restore every member of a cluster that contains a compromised appliance. If you can’t, contact TAC.

If nothing is found, Cisco says to upgrade to a fixed release if you run an affected version.

Secure Email Cloud customers: Cisco says it investigated, contacted affected customers and deployed mitigations. Contacted customers should renew credentials and cryptographic material where possible. All customers should restrict access to the appliance.

Hardening Cisco recommends: block internet access to the appliance or allow only trusted hosts, keep mail and management traffic on separate interfaces, put the appliance behind a filtering firewall, send logs to an external server, disable HTTP for the admin portal and unneeded services, and change the default admin password. See also Cisco’s hardening advisory cisco-sa-hardening-esa-dfCrfXkm.

CISA’s KEV due date is 2026-10-17. Its required action is to apply the vendor mitigations, follow BOD 26-04 and complete forensic triage.

Detection

Cisco’s indicator is a log check. Run it on each device (every member of a cluster):

esa-appliance> grep "System Security" system_logs

Log message	What Cisco says to do
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.	Compromise detected. Follow the recovery steps above.
System Security: Security scan did not complete. Contact TAC for further recommendations.	Contact Cisco TAC.
System Security: No compromise indicator was found.	No compromise detected. Upgrade if applicable.

Limits to keep in mind:

• Root access lets an attacker hide evidence, so a clean result is not proof. Cisco recommends cross-checking network and firewall logs for unexpected uploads to external IPs or downloads from malicious IPs.
• Secure Email Cloud administrators without CLI access may be unable to run the check. Cisco says it contacted customers whose cloud devices showed malicious activity.
• Cisco has published no IP addresses, file hashes or file paths for this campaign.