Cisco says attackers are already using a flaw in Secure Email Gateway that needs no login on the appliance. A crafted attachment can write files and run commands as root when File Reputation is turned on.
What happened
CVE-2026-76519 is a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway. Cisco scores it 9.8. An unauthenticated remote attacker sends an email with a crafted attachment through an affected appliance. If the attack succeeds, the attacker can write arbitrary files and execute commands with root privileges on the underlying operating system.
Cisco's Product Security Incident Response Team said in October 2026 that it became aware of active exploitation. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 14 October 2026, with a federal remediation date of 17 October 2026. There is no workaround. Cisco also warns that root access can be used to delete or hide evidence on the box, so logs on the appliance alone are not enough.
Who is affected
Physical and virtual Cisco Secure Email Gateway appliances are affected only when both of these are true:
- The File Reputation service, part of Cisco AMP, is enabled and assigned to a mail policy.
- Content Scanner Tools is earlier than 25.3.0.5525.
Cisco lists fixed AsyncOS releases as 15.5.5-014 and 16.5.0-780. The 16.0 branch has no fix of its own; those appliances must move to a fixed release. Content Scanner Tools 25.3.0.5525 and later also contain the fix and do not need a software upgrade or a restart. Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco says Secure Email Cloud customers do not need to act on the scanner update, and that it has contacted cloud customers where it saw possible compromise.
What to do now
Update Content Scanner Tools to 25.3.0.5525 or later, or move AsyncOS to 15.5.5-014 or 16.5.0-780, then check logs for compromise.
- On the CLI, run contentscannerstatus. If the tools version is below 25.3.0.5525, run contentscannerupdate, or turn automatic updates back on under Security Services, Service Updates.
- If you cannot take the scanner update, upgrade 15.5 to 15.5.5-014 and 16.5 to 16.5.0-780. Do not stay on 16.0; migrate off that branch.
- Search system_logs for "System Security". A line that a suspected compromise indicator was found, or that a security scan did not complete, means contact Cisco TAC. On a virtual appliance you suspect was hit, keep forensic copies first, then rebuild from a fixed image without importing the old configuration, and rotate credentials and keys. If one cluster member is compromised, treat the whole cluster as exposed, because SSH keys used between members may have been read.
- Compare firewall logs for unexpected uploads from the appliance. Root access can wipe the device's own traces.
What this means for South African businesses
Most small firms never buy this appliance. The ones that do are usually mid-size companies, schools, and shared mail platforms that still filter mail on-premises rather than in Microsoft 365. If File Reputation is on, the gateway is in the path of every external message, so the attacker does not need a password, only the ability to send mail. That is a higher practical risk than a flaw that sits behind an admin login.