{"id":"cisco-secure-email-gateway-file-write-oct-2026","category":"patch","status":"closed","title":"Cisco Secure Email Gateway CVE-2026-76519 exploited: crafted email attachment gives attackers root; fixes available","tldr":"Cisco Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) is being exploited. A crafted email attachment can give an unauthenticated attacker root. Fixes exist (15.5.5-014, 16.5.0-780, or Content Scanner Tools 25.3.0.5525). Businesses running the gateway should update now.","summary":"Cisco has fixed a critical flaw, CVE-2026-76519, in Cisco Secure Email Gateway, the appliance some organisations use to filter email. An attacker with no login can send an email with a crafted attachment and write files to the device's operating system, which Cisco says can lead to commands running as root. Only gateways with File Reputation (part of Advanced Malware Protection) switched on and assigned to a mail policy, and with Content Scanner Tools older than 25.3.0.5525, are affected. Secure Email and Web Manager and Secure Web Appliance are not. Cisco says attackers are exploiting it and found it through its own internal scanning. There is no workaround. Fixes are AsyncOS 15.5.5-014 and 16.5.0-780; for 16.0 Cisco says to migrate to a fixed release. The Content Scanner Tools update can be applied without an upgrade or restart. Cisco contacted Cloud customers who showed signs of compromise. Shadowserver tracks nearly 300 exposed gateways. The advisory has had no revisions since 14 October. This is not a home product.","action":"Nothing for most families, as this is business equipment. If you or a family office run a Cisco Secure Email Gateway, update to 15.5.5-014 or 16.5.0-780, or apply Content Scanner Tools 25.3.0.5525 or later, and ask your IT provider to check for signs of compromise.","product":"Cisco Secure Email Gateway (AsyncOS, physical and virtual)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-76519"],"tags":["cisco","secure-email-gateway","asyncos","zero-day","exploited","email-security","cisa-kev"],"affected":["Cisco Secure Email Gateway (physical and virtual) running AsyncOS with File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525"],"fixed":["AsyncOS 15.5.5-014","AsyncOS 16.5.0-780","Content Scanner Tools 25.3.0.5525 or later","AsyncOS 16.0: migrate to a fixed release"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","by":"Cisco","date":"2026-10-14"},{"kind":"news","title":"Cisco patches actively exploited Secure Email Gateway zero-day","url":"https://bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day","by":"BleepingComputer","date":"2026-10-14"}],"started":"2026-10-14","closed":"2026-10-14","created":"2026-11-03T21:57:03.931Z","updated":"2026-11-03T21:57:03.931Z","cve_notes":[{"cve":"CVE-2026-76519","name":"Arbitrary file write in Cisco Secure Email Gateway AMP","what":"A path traversal flaw in how the gateway's Advanced Malware Protection handles email attachments, which lets an unauthenticated attacker write files to the operating system and run commands as root.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-10-14","added":"2026-11-03T21:56:13.587Z","kind":"other","text":"BleepingComputer reported Cisco had published indicators of compromise, deployed mitigations on its own cloud infrastructure and contacted Secure Email Cloud customers who showed signs of compromise. Shadowserver tracks nearly 300 internet-exposed gateways. Cisco gave no details of the attacks.","url":"https://bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day","by":"BleepingComputer","patch":null},{"at":"2026-10-14","added":"2026-11-03T21:56:13.587Z","kind":"cisa-added","text":"CISA added CVE-2026-76519 to its list of flaws being used in attacks, according to the report supplied to HARD. A search summary says federal agencies were told to patch by 17 October; HARD did not read CISA's own entry.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","by":"CISA","patch":null},{"at":"2026-10-14","added":"2026-11-03T21:56:13.587Z","kind":"disclosed","text":"Cisco published advisory cisco-sa-esa-afw-zqYJkjxp for CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway. It said its PSIRT knew of active exploitation in October 2026 and listed fixes for AsyncOS 15.5 and 16.5, plus a Content Scanner Tools update.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","by":"Cisco","patch":"patched"}],"url":"https://hard.fyi/live/cisco-secure-email-gateway-file-write-oct-2026/","json":"https://hard.fyi/api/live?id=cisco-secure-email-gateway-file-write-oct-2026"}