lee1981 (@lee1981b) on X

What it is

CVE-2026-76519 is a relative path traversal (CWE-23) in the AMP File Reputation and Content Scanner Tools path of Cisco Secure Email Gateway (physical and virtual). Cisco CNA scores it CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The advisory is cisco-sa-esa-afw-zqYJkjxp (bug CSCwu56223), published 14 Oct 2026. CISA added it to KEV on 14 Oct with a recorded due date of 17 Oct, and CISA's SSVC entry reads Exploitation active, Automatable yes, Technical Impact total. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.

Preconditions / Affected

All three must hold on a node:

flowchart LR
  A[Vulnerable AsyncOS] --> D{Exposed}
  B[File Reputation enabled and assigned to a mail policy] --> D
  C[Content Scanner Tools below 25.3.0.5525] --> D

• A global feature label does not settle applicability. Check the effective incoming and outgoing AMP policies.
• The scanner updates separately from AsyncOS, so an older AsyncOS may already carry the fixed scanner. Record the running package per node.
• The CNA lists 23 affected builds. It does not encode the full policy and package prerequisites.
• The page gives no exploit details. The attachment format, written path and payload are undisclosed, and exploitation is dated only to "October 2026".

What to do

1. Fix. Pick one route: - Content Scanner Tools 25.3.0.5525 or later. This needs no AsyncOS upgrade and no restart, and it goes only to licensed, supported releases. - AsyncOS 15.5.5-014. - AsyncOS 16.5.0-780. Cisco recommends this for anything older than 16.5. - AsyncOS 16.0 has no hotfix, so migrate. - Cisco publishes no workaround. Separating interfaces and restricting management access is hardening only, because the mail route stays open.
2. Verify. An auto-update checkbox, a "check requested" response or a scheduled job is not proof. Confirm the running scanner and AsyncOS on every cluster member.
3. Preserve evidence before upgrading where feasible. Cisco warns that upgrading a compromised instance destroys logs and forensics, and that root access can hide evidence. Collect system_logs, mail_logs, AMP, updater and audit logs, plus off-device firewall or flow history. Do not open or replay suspect attachments.
4. Read the System Security scan results in system_logs on every member: - Suspected indicator: follow Cisco's compromise recommendations and treat it as an incident. - Incomplete scan: open a TAC case. This is not a negative result. - No indicator: this is a bounded result only, since root-level attackers can hide evidence. Missing output is not a clean scan.
5. Correlate using MID, ICID and DCID, scoped by node and UTC time. Compare appliance uploads and downloads against firewall history. Normal AMP analysis uploads and service updates can explain egress, so a malicious-file verdict alone does not identify this CVE.
6. Recover, if compromise is suspected: - Physical appliance: contact TAC. - Virtual appliance: deploy a new VM on a fixed release and rebuild the configuration without importing the old one. Then renew the credentials and cryptographic material installed on the appliance. - Cluster: one compromised member means restoring every member to a secure configuration, because private SSH keys used between members may be exposed. If restoration is not possible, contact TAC. - Cloud Gateway: the fixed scanner is already deployed and customers need no update action. Cisco says it has contacted customers with possible compromise indicators.

Caveats

• The page publishes no actor-specific IPs, domains or hashes, so there is nothing to block or match. Cisco's scan strings are the only indicators.
• FIRST EPSS returned no data, which means unavailable, not zero. NVD was still undergoing analysis and shows only Cisco's score.
• No public exploit was verified, and a GitHub query found nothing. The page says this does not rule one out.
• This is a secondary digest from a third party. The page says the primary advisory was readable but the logging-guide captures returned 403.
• The recorded KEV due date applies under BOD 26-04 and is not a universal deadline.
• A fixed scanner does not address historical compromise, exposed cluster keys or unsupported AsyncOS releases.