{"id":"CVE-2026-76519","kind":"vulnerability","aliases":["CVE-2026-76519"],"related":[],"title":"cisco asyncos: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…","description":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Cisco Secure Email Gateway (physical and virtual) AMP feature mishandles email attachments when File Reputation is enabled; an unauthenticated attacker sending a crafted attachment can write arbitrary files and run commands as root. Cisco PSIRT confirms active exploitation (October 2026). Not affected: Secure Email and Web Manager, Secure Web Appliance. No workarounds.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-10-14T00:00:00+00:00","products":[{"name":"Cisco Secure Email Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Cisco Secure Email Gateway (AsyncOS)","fixed":["15.5.5-014","16.5.0-780","Content Scanner Tools 25.3.0.5525"],"affected":"AsyncOS 15.5 before 15.5.5-014; 16.0 all; 16.5 before 16.5.0-780; with File Reputation enabled and Content Scanner Tools < 25.3.0.5525","ecosystem":"vendor"},{"name":"cisco asyncos","fixed":["15.5.5-014"],"affected":">= 15.0, < 15.5.5-014","ecosystem":"vendor"},{"name":"cisco asyncos","fixed":["16.5.0-780"],"affected":">= 16.0, < 16.5.0-780","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asyncos","cisco","email-security","exploited","secure-email-gateway","self-hosted","vendor"],"not_affected_if":["content-scanner-tools-25.3.0.5525+","file-reputation-disabled","managed-hosting"],"how_to_check":"Vulnerable only if BOTH: (1) Content Scanner Tools is older than 25.3.0.5525 (CLI: contentscannerstatus) and (2) Enable File Reputation is checked on a mail policy (Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection). Compromise check: grep \"System Security\" system_logs on each cluster member; 'Suspected compromise indicator was found' means compromised. Attackers with root may erase evidence, so also check external firewall/network logs for unexpected uploads or downloads.","fix":"Fastest: update Content Scanner Tools to 25.3.0.5525 or later (CLI: contentscannerupdate, or enable automatic updates under Security Services > Service Updates); no upgrade or restart needed. Or upgrade AsyncOS: 15.5 -> 15.5.5-014, 16.5 -> 16.5.0-780, 16.0 -> migrate to a fixed release (Cisco recommends 16.5.0-780). If compromised: keep forensics first (upgrading destroys logs), physical appliances contact Cisco TAC, virtual appliances rebuild on a fixed release without importing old config, rotate credentials and crypto material, and rebuild every cluster member (cluster SSH keys may be stolen). Restrict internet access to the appliance. Secure Email Cloud: no action needed.","status":"open","published_at":"2026-10-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:00+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.93,"triage":{"at":"2026-10-23T19:50:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patches from Cisco's vendor advisory; if none are available, CISA says to discontinue use of the product. Affected and fixed versions are not stated in the sources.","summary":"Cisco Secure Email Gateway has a relative path traversal flaw that lets an unauthenticated remote attacker write arbitrary files on the underlying operating system. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["cisco","secure-email-gateway","email-security"],"confidence":0.7,"analyst_note":"Get affected and fixed versions and the Cisco advisory URL from the CISA KEV entry or Cisco PSIRT for CVE-2026-76519, and the specific mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000379,"input_tokens":2236,"output_tokens":310,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Get affected and fixed versions and the Cisco advisory URL from the CISA KEV entry or Cisco PSIRT for CVE-2026-76519, and the specific mitigation steps.","search":"'-04':147C,173C,204C '-2026':20A,23A '-76519':21A,24A '2026':91B '26':146C,172C,203C 'accord':136C 'action':132C 'activ':88B 'adher':200C 'advanc':7A 'affect':93B 'allow':18A,116C 'amp':10A,59B 'appli':133C 'applianc':101B 'applic':170C 'arbitrari':78B,123C 'asset':194C 'asynco':2A,38B 'asyncos':33A,35A,37A 'attach':63B,75B 'attack':71B,120C 'base':151C 'bod':145C,171C,202C 'cisa':130C,143C,160C 'cisco':1A,13A,25A,29A,34A,36A,39B,52B,85B,104C 'cloud':176C 'command':82B 'complianc':141C 'confirm':87B 'contain':108C 'could':17A,115C 'craft':74B 'cve':19A,22A 'discontinu':179C 'email':15A,27A,31A,41B,46B,54B,62B,95B,106C 'email-secur':40B 'enabl':68B 'ensur':140C,199C 'evalu':192C 'exploit':43B,89B 'exposur':197C 'featur':11A,60B 'file':65B,79B,124C 'follow':169C 'forens':162C 'gateway':16A,28A,32A,47B,55B,107C 'guidanc':158C,174C 'guidelin':206C 'host':50B 'instruct':139C 'internet':196C 'malwar':8A 'manag':98B 'mishandl':61B 'mitig':134C,185C 'note':157C,168C 'octob':90B 'oper':128C 'patch':205C 'path':111C 'physic':56B 'priorit':148C 'product':183C 'protect':9A 'psirt':86B 'relat':110C 'remot':119C 'reput':66B 'requir':131C,164C 'respons':190C 'risk':153C 'root':84B 'run':81B 'secur':14A,42B,45B,53B,94B,99B,105C,149C 'secure':26A,30A 'secure-email-gateway':44B 'see':154C,165C 'self':49B 'self-host':48B 'send':72B 'servic':177C 'stakehold':188C 'system':129C 'travers':112C 'triag':163C 'unauthent':70B,118C 'unavail':187C 'under':127C 'updat':150C 'url':155C,166C 'use':180C 'vendor':51B,138C 'virtual':58B 'vulner':4A,113C 'web':97B,100B 'workaround':103B 'write':77B,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-14T00:00:00+00:00","kev":{"dateAdded":"2026-10-14","dueDate":"2026-10-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-76519","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76519","severity":null,"published_at":"2026-10-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T20:35:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76519:7","url":null,"severity":null,"published_at":"2026-10-23T20:18:10+00:00","modified_at":"2026-10-23T20:18:10+00:00","first_seen_at":"2026-10-23T20:18:10+00:00","fetched_at":"2026-10-23T20:18:10+00:00","note":"Read Cisco advisory cisco-sa-esa-afw-zqYJkjxp (Oct 14 2026): CVSS 9.8, AMP file-reputation path traversal -> root RCE via crafted email attachment, exploited per Cisco PSIRT; no workarounds; no public PoC found. Fixed via Content Scanner Tools >= 25.3.0.5525 (no restart) or AsyncOS 15.5.5-014 / 16.5.0-780."},{"source":"nvd","external_id":"CVE-2026-76519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519","severity":null,"published_at":"2026-10-14T17:19:10+00:00","modified_at":"2026-10-15T13:47:19+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":465,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","title":"Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":466,"url":"https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/","title":"Cisco patches new Secure Email Gateway zero-day exploited in attacks","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}