Cisco Secure Email Gateway Flaw CVE-2026-76519 Lets Attackers Run Root Code; CISA Adds It to KEV

Cisco has confirmed that its Secure Email Gateway appliance is under active attack through a flaw it rated 9.8 out of 10 on the Common Vulnerability Scoring System. The vulnerability, tracked as CVE-2026-76519, is a relative path-traversal bug in the Advanced Malware Protection (AMP) feature. An unauthenticated, remote attacker needs only to route a crafted email attachment through a vulnerable appliance to write arbitrary files on the underlying operating system. From there, the attacker can execute commands with root privileges on the machine.

On October 14, 2026, CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog, alongside three other flaws: a Palo Alto Networks PAN-OS code injection bug (CVE-2026-0322) and a pair of vulnerabilities in Ahsay's AhsayCBS backup software, a medium-severity improper authentication flaw (CVE-2026-105133) and a critical command injection flaw (CVE-2026-105134). Under CISA's Binding Operational Directive 26-04, federal civilian agencies must remediate newly listed vulnerabilities by the assigned deadline. For the Cisco flaw, that deadline is October 17, 2026, one day before the CISA federal holiday deadline for the rest of the batch.

What is CVE-2026-76519?

The flaw sits in Cisco Secure Email Gateway's AMP feature, which scans email attachments by sending them to a file reputation service. The bug is in how the gateway handles attachment filenames: a malicious attachment can craft a file path that tricks the scanner into writing attacker-controlled content outside its intended directory. Cisco classifies the issue as CWE-23 (path traversal). The CVSS 3.1 base score is 9.8 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the attack is network-reachable, requires no privileges and no user interaction, and yields full confidentiality, integrity, and availability control.

Two conditions determine whether a deployment is exposed. First, the File Reputation service must be enabled and assigned to at least one mail policy. Second, the appliance must be running a Content Scanner Tools release earlier than 25.3.0.5525. Both physical and virtual Secure Email Gateway appliances are affected. Cisco notes there are no workarounds; the only remediation is to upgrade.

How the exploit works in practice

Because the vulnerability requires no authentication and no user interaction on the appliance itself, defenders cannot rely on catching a login or a phishing click. The attack surface is the mail flow itself: an attacker who can deliver an email through the gateway, from any source address the gateway accepts, can trigger the file write. The practical impact is a remote root shell on a device that organizations buy specifically to sit between the internet and internal email infrastructure and to stop exactly this kind of content-based attack.

Cisco disclosed the flaw under its expanded advisory policy that began in June 2026, in which bugs fixed in routine hardening releases share grouped CVE identifiers, and an individual CVE is issued when a flaw is known to be exploited. The file-write bug was fixed inside the path-traversal CWE group in the September 2026 hardening release; after Cisco became aware of in-the-wild attacks in October, it carved the flaw out as CVE-2026-76519 and published a dedicated advisory on October 14. Cisco says it discovered the flaw through its own internal security scanning, and the advisory does not disclose the number of targeted devices, the operators behind the attacks, or whether any attacker achieved persistence beyond command execution.

Patch guidance and remediation

Cisco's recommended fix is to upgrade Content Scanner Tools to 25.3.0.5525 or later, which Cisco notes does not require a restart, or to move to an affected-series AsyncOS release of 15.5.5-014 or 16.5.0-780 or later. Organizations running older Content Scanner Tools builds with File Reputation enabled should treat the gateway as potentially compromised: assume the attacker has root write access to the appliance and perform post-compromise forensics, including a review of filesystem changes, cron entries, outbound connections, and any lateral movement into mail flow itself. The same hardening release also addresses Cisco's separately tracked September 2026 SQL injection flaw in Secure Email Gateway, which the company also now reports as actively exploited.

Why the KEV listing matters

A KEV listing is CISA's confirmation that exploitation is not hypothetical but observed. The October 14 batch is notable for spanning three unrelated product families: a data-center firewall management interface, an email security appliance, and on-premises backup software. A shared pattern is that all four vulnerabilities are reachable from the network without credentials, which is why all four carry forensic triage requirements under BOD 26-04. Defenders who triage patching by vendor release cadence rather than by exposure should be pulling Cisco Secure Email Gateway ahead of schedule this week.

What this means for you

If you operate Cisco Secure Email Gateway with File Reputation enabled, check your Content Scanner Tools version immediately. Anything below 25.3.0.5525 is exposed to unauthenticated root compromise, and CISA's October 17 federal deadline signals that active campaigns are underway. If you cannot patch quickly, plan for the worst: an attacker with root on your email gateway can silently modify, redirect, or read everything that passes through it. For everyone else, treat the four-flaw KEV batch as a reminder that your highest-risk exposure is often not the newest zero-day but the unpatched, network-exposed appliance with no authentication barrier.

Bottom line

Cisco Secure Email Gateway deployments are the priority this week. CVE-2026-76519 combines a maximum-severity rating, an unauthenticated network path to root, confirmed active exploitation, and no workaround. The fix is a routine Content Scanner Tools update, but organizations that ignore it should expect to explain a compromised email gateway within months rather than days.

Sources: Cisco Security Advisory: Cisco Secure Email Gateway Arbitrary File Write Vulnerability; CISA: Adds Four Known Exploited Vulnerabilities to Catalog; Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products.

Corrections: Report an error at corrections@wireshaman.com.