Cisco Secure Email Gateway CVE-2026-76519: root from one email

Most appliance bugs need an exposed admin page or a login. CVE-2026-76519 needs an email. An unauthenticated attacker sends a message with a crafted attachment through a Cisco Secure Email Gateway, and the gateway's own malware scanning ends up writing attacker-chosen files and running commands as root. The catch is that only gateways with one feature on, and one component out of date, are vulnerable.

Cisco published the advisory on 14 October 2026, saying its PSIRT had become aware of active exploitation that month. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, with a 17 October deadline. The fixed AsyncOS builds are the same ones Cisco shipped in a September hardening release, and how the two advisories relate is still not fully confirmed by Cisco.

Who is affected

Physical and virtual Cisco Secure Email Gateway appliances, when both conditions below hold. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected.

The two conditions are:

• File Reputation (part of Advanced Malware Protection) is enabled and assigned to at least one incoming or outgoing mail policy.
• Content Scanner Tools is older than 25.3.0.5525.

Cisco recommends that anything older than AsyncOS 16.5 migrate to 16.5.0-780. It also distributes the fix to all licensed, supported AsyncOS releases through the Content Scanner Tools package.

How CVE-2026-76519 works

When File Reputation is on, the gateway processes attachments for reputation lookups. Cisco says it handles those attachments improperly: a relative path traversal (CWE-23) lets a crafted attachment write files outside the place they belong. Arbitrary file write as root becomes command execution as root on the underlying operating system.

The attacker needs no account and no access to the management interface; mail delivery is the attack path. Cisco scores it 9.8 under CVSS 3.1, and found it during internal security scanning. Cisco has not published deeper technical detail.

The September hardening release

On 14 September 2026, Cisco published a hardening advisory for Secure Email Gateway and Secure Email and Web Manager that fixed five CVEs, including CVE-2026-76440, a CWE-23 path traversal scored 9.8. Its fixed gateway builds are the same 15.5.5-014 and 16.5.0-780.

On 14 October, Cisco updated that advisory to say two of its issues are actively exploited, one path traversal and one injection flaw, and linked the CVE-2026-76519 advisory. SecurityWeek reports that the CVE-2026-76519 fix shipped in September under CVE-2026-76440. Cisco's own text does not say that, so treat the renaming as unverified. In practice, a gateway upgraded to those builds in September runs a fixed AsyncOS release.

Is it being exploited?

Yes. Cisco PSIRT says it became aware of active exploitation in October 2026. CISA listed the CVE in KEV on 14 October with a 17 October due date and marked forensic triage as required under BOD 26-04. Ransomware use is listed as unknown.

What is not known: who is behind the attacks, when they began and how many gateways were hit. Cisco has contacted Secure Email Cloud customers whose systems showed indicators of compromise. SecurityWeek calls this the second Secure Email Gateway flaw exploited since mid-September, after CVE-2026-76461, which BleepingComputer describes as a separate bug in AsyncOS email parsing.

Check your exposure

From the gateway CLI, on every cluster member:

# AsyncOS release.
version
 
# Content Scanner Tools version; vulnerable if older than 25.3.0.5525.
contentscannerstatus
 
# Cisco's compromise check.
grep "System Security" system_logs

Then check File Reputation in the web interface: Mail Policies, Incoming Mail Policies (and Outgoing), Advanced Malware Protection, and look for Enable File Reputation on each policy.

Fix it

Update Content Scanner Tools first. Cisco says it needs no software upgrade or restart: run contentscannerupdate, or turn on automatic updates under Security Services, Service Updates. Then upgrade AsyncOS to 15.5.5-014 or 16.5.0-780. Cisco says no workarounds exist.

If a gateway shows signs of compromise, Cisco's recovery steps depend on the platform:

• Virtual appliances. Preserve forensic data first, because upgrading a compromised instance destroys it. Deploy a new VM on a fixed release, rebuild the configuration without importing old configuration files, and renew all credentials and cryptographic material.
• Clusters. Restore every member, since cluster SSH keys may have been exposed.
• Physical appliances. Contact Cisco TAC and enable remote access for the investigation.

Detect attempts and compromise

Cisco's check prints one of three results:

• Suspected compromise indicator was found. Treat the gateway as compromised, contact TAC and follow the recovery steps above.
• Security scan did not complete. Contact TAC.
• No compromise indicator was found. Upgrade if you have not already.

Root access lets an attacker hide evidence on the device, so Cisco also recommends looking outside it: firewall and network logs showing unexpected uploads from the gateway to external IPs, or downloads from malicious ones.

Beyond this patch

Security appliances parse hostile input for a living, which makes their scanning engines part of the attack surface. Track feature-level conditions and content packages as carefully as firmware versions, and send appliance logs somewhere an attacker with root cannot edit. The SOC pipeline docs describe how Rokkhe handles forwarded alerts.