Cisco Warns of Exploited Secure Email Gateway Vulnerability

What it is

CVE-2026-76519 (CVSS 9.8) is an unauthenticated arbitrary file write in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. Cisco PSIRT became aware of active exploitation in October 2026. CISA added it to KEV with a federal patch deadline of October 17.

How it works

A remote attacker emails a crafted attachment. Attachment handling writes arbitrary files to the underlying OS, which leads to command execution as root.

Preconditions / Affected

• The file reputation service is enabled.
• Content Scanner Tools is older than 25.3.0.5525.

What to do

• Patch: move to AsyncOS 15.5.5-014 or 16.5.0-780. These shipped September 14.
• Find the original advisory: the September advisory listed this flaw under CVE-2026-76440, not its own ID. Searching for CVE-2026-76519 alone may miss it. Cisco updated that advisory on Wednesday to note exploitation.
• Hunt off-box: Cisco warns that attackers with root can remove or hide evidence on the appliance. Check network and firewall logs outside the device for unexpected uploads or downloads to or from external IPs, and compare against Cisco's published IoCs.
• Physical appliances: if you suspect compromise, contact Cisco TAC.
• Virtual appliances: deploy a new VM on a fixed release, rebuild the product configuration from scratch, and rotate credentials. Preserve forensic evidence.
• Secure Email Cloud: Cisco says it has contacted affected customers directly and already deployed the mitigations within its control. Customers who haven't been contacted need to do nothing based on this page.

Caveats

• Patches have been available since September 14, so appliances unpatched since then have been exposed for weeks, and the exploitation window predates the October disclosure.
• Patching alone does not remove an existing compromise. Cisco's rebuild guidance for virtual appliances implies that a patch applied after compromise is not enough.
• This is the second exploited unauthenticated root-command-execution bug in Secure Email Gateway since mid-September, after CVE-2026-76461. Check that both are covered.