---
id: "CVE-2026-76519"
kind: "vulnerability"
aliases: ["CVE-2026-76519"]
title: "cisco asyncos: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Cisco Secure Email Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Cisco Secure Email Gateway (AsyncOS)", "fixed": ["15.5.5-014", "16.5.0-780", "Content Scanner Tools 25.3.0.5525"], "affected": "AsyncOS 15.5 before 15.5.5-014; 16.0 all; 16.5 before 16.5.0-780; with File Reputation enabled and Content Scanner Tools < 25.3.0.5525", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["15.5.5-014"], "affected": ">= 15.0, < 15.5.5-014", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["16.5.0-780"], "affected": ">= 16.0, < 16.5.0-780", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asyncos", "cisco", "email-security", "exploited", "secure-email-gateway", "self-hosted", "vendor"]
not_affected_if: ["content-scanner-tools-25.3.0.5525+", "file-reputation-disabled", "managed-hosting"]
published_at: "2026-10-14T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76519", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:18:10+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76519", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# cisco asyncos: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…

Cisco Secure Email Gateway (physical and virtual) AMP feature mishandles email attachments when File Reputation is enabled; an unauthenticated attacker sending a crafted attachment can write arbitrary files and run commands as root. Cisco PSIRT confirms active exploitation (October 2026). Not affected: Secure Email and Web Manager, Secure Web Appliance. No workarounds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Secure Email Gateway affected ? fixed ?
- vendor:Cisco Secure Email Gateway (AsyncOS) affected AsyncOS 15.5 before 15.5.5-014; 16.0 all; 16.5 before 16.5.0-780; with File Reputation enabled and Content Scanner Tools < 25.3.0.5525 fixed 15.5.5-014, 16.5.0-780, Content Scanner Tools 25.3.0.5525
- vendor:cisco asyncos affected >= 15.0, < 15.5.5-014 fixed 15.5.5-014
- vendor:cisco asyncos affected >= 16.0, < 16.5.0-780 fixed 16.5.0-780

## How to check

Vulnerable only if BOTH: (1) Content Scanner Tools is older than 25.3.0.5525 (CLI: contentscannerstatus) and (2) Enable File Reputation is checked on a mail policy (Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection). Compromise check: grep "System Security" system_logs on each cluster member; 'Suspected compromise indicator was found' means compromised. Attackers with root may erase evidence, so also check external firewall/network logs for unexpected uploads or downloads.

## Fix

Fastest: update Content Scanner Tools to 25.3.0.5525 or later (CLI: contentscannerupdate, or enable automatic updates under Security Services > Service Updates); no upgrade or restart needed. Or upgrade AsyncOS: 15.5 -> 15.5.5-014, 16.5 -> 16.5.0-780, 16.0 -> migrate to a fixed release (Cisco recommends 16.5.0-780). If compromised: keep forensics first (upgrading destroys logs), physical appliances contact Cisco TAC, virtual appliances rebuild on a fixed release without importing old config, rotate credentials and crypto material, and rebuild every cluster member (cluster SSH keys may be stolen). Restrict internet access to the appliance. Secure Email Cloud: no action needed.

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76519
- 2026-10-23T20:18:10+00:00 analyst — Read Cisco advisory cisco-sa-esa-afw-zqYJkjxp (Oct 14 2026): CVSS 9.8, AMP file-reputation path traversal -> root RCE via crafted email attachment, exploited per Cisco PSIRT; no workarounds; no public PoC found. Fixed via Content Scanner Tools >= 25.3.0.5525 (no restart) or AsyncOS 15.5.5-014 / 16.5.0-780.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76519

## Documents

- [advisory] Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
- [discussion] Cisco patches new Secure Email Gateway zero-day exploited in attacks https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/

## From the sources

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_