Vulnerabilities
Cisco email gateway attachment flaw gives root, patch it
CVE-2026-76519 lets one crafted attachment write files and run commands as root on Cisco Secure Email Gateway. Who is exposed, fixes, checks, cleanup.
Cisco published an advisory on Wednesday, October 14, for CVE-2026-76519, a CVSS 9.8 flaw in Cisco Secure Email Gateway that attackers are already exploiting. Anyone who can send mail through the gateway can attach a crafted file that makes the appliance write arbitrary files to its own operating system, and Cisco says that can lead to commands running as root. No account is needed and no user has to open anything. Cisco's Product Security Incident Response Team (PSIRT) learned of the attacks in October.
Not every gateway is exposed. Both of these have to be true: File Reputation, part of Cisco's Advanced Malware Protection (AMP), is enabled and assigned to a mail policy, and the Content Scanner Tools package is older than 25.3.0.5525. Physical and virtual gateways count. Secure Email and Web Manager and Secure Web Appliance are not affected. The main fix is a scanner update that installs without an upgrade or restart, so most gateways can be closed today.
How it works
File Reputation checks each attachment against Cisco's threat intelligence cloud before the message is delivered, so the gateway handles every attachment that crosses a policy with the feature switched on. Cisco says the flaw is improper handling of email attachments when file reputation is enabled, and classes it as CWE-23, relative path traversal. In that bug class, a name or path inside the input contains sequences such as ../, and the code that saves it does not strip them, so the file lands outside the working folder it was meant for.
Cisco has not said which field in the attachment carries the traversal or which files attackers overwrite. The usual route from an arbitrary file write to code execution is to place or replace a file that the system later runs or loads. Cisco confirms the end result, commands as root, but the exact path an attacker takes there is not public.
The fix ships in Content Scanner Tools, the attachment scanning package that Cisco updates separately from AsyncOS, the gateway's operating system. That is why patching does not need a full upgrade.
What attackers are doing
Cisco found the flaw during its own internal security scanning and then saw it used. The advisory does not say how many gateways were attacked, who is behind it, or whether any attacker actually reached root. For its hosted Secure Email Cloud service, Cisco says it contacted the customers whose gateways showed malicious activity and is handling their remediation.
This is the third root-level bug in these appliances to be exploited in under a year. A China-linked group that Cisco Talos tracks as UAT-9686 used CVE-2025-20393, a CVSS 10.0 flaw in the Spam Quarantine web interface, from late 2025. Then on September 14, 2026, Cisco disclosed CVE-2026-76461, a CVSS 9.8 SQL injection in AsyncOS email parsing that affects every configuration. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog that day with a September 17 deadline for US federal agencies.
The new advisory is tied to Cisco's September 14 hardening release, which grouped internally found bugs under five CVEs by weakness type, four rated 9.8 and one rated 7.5. On October 14 Cisco updated it to say two of those bugs are known to be exploited: one in the path traversal class (the arbitrary file write) and one in the SQL injection class. The 15.5.5-014 and 16.5.0-780 builds listed as fixed for CVE-2026-76519 are the ones that release shipped. RedLegg reads Cisco's table as pairing 16.5.0-780 with the new scanner, so check the scanner version even on a gateway upgraded in September. Cisco has not linked the two exploited flaws to the same attacker, and each has its own log check.
What to do
1. Find out if you are exposed
In the web interface, go to Mail Policies > Incoming Mail Policies > Advanced Malware Protection, and the same under Outgoing Mail Policies. Open each policy and see whether "Enable File Reputation" is ticked. Then run contentscannerstatus at the command line interface (CLI). Cisco's example of a vulnerable gateway shows version 25.2.0.5427.15.5.001 with "Never updated" in the Last Updated column, which is a sign automatic updates are off.
2. Update Content Scanner Tools now
Run contentscannerupdate from the CLI, then run contentscannerstatus again and confirm 25.3.0.5525 or later. To stop this happening again, go to Security Services > Service Updates, click Edit Update Settings, tick Automatic Updates, submit and commit the change. Hosted Secure Email Cloud gateways have already been updated by Cisco.
3. Plan the AsyncOS upgrade
The fixed releases are 15.5.5-014 and 16.5.0-780. Release 16.0 has no fixed build: 16.0.4-302, which fixed the September SQL injection, does not cover this flaw, so 16.0 gateways have to move to another train. Cisco recommends that anything older than 16.5 go to 16.5.0-780.
There is no workaround. Turning File Reputation off would remove the first condition, but Cisco does not list it as a mitigation and it removes a malware control, so update the scanner instead.
4. Check whether you were hit
Run grep "System Security" system_logs on the gateway, and on every member if it is clustered. There are three possible results. "Suspected compromise indicator was found" means treat it as compromised and go to step 5. "Security scan did not complete" means open a case with Cisco's Technical Assistance Center (TAC). "No compromise indicator was found" means this check found nothing.
A clean result is not proof. An attacker with root can edit local logs, and Cisco has not said what the scan looks for. Check records the gateway cannot touch: firewall and proxy logs for uploads from the gateway to unfamiliar external addresses and downloads of tools from known bad ones. If you only have the hosted service and no CLI, you cannot run this check yourself; Cisco says it has contacted the affected cloud customers.
5. If a gateway is compromised
For a virtual appliance, collect logs and a disk image before anything else, because upgrading a compromised instance destroys the evidence. Then deploy a new virtual machine on a fixed release and rebuild the configuration by hand rather than importing the old configuration file, which could carry the attacker's changes. For a physical appliance, open a TAC case and enable remote access for Cisco's engineers.
Clusters need extra care. Members authenticate to each other with SSH key pairs, so a private key taken from one compromised member can be used against the others. Cisco recommends restoring every member of a cluster that had even one compromised gateway. Afterwards, renew the credentials and cryptographic material installed on the appliances, such as admin passwords, LDAP bind accounts and TLS private keys.
The wider lesson
Content Scanner Tools updates separately from AsyncOS, and the "Never updated" example in Cisco's advisory shows how easy it is to leave that switch off. Add the scanner version to whatever you use to track appliance patch levels. Keep the gateway's management interface off the internet and on a separate interface from mail traffic, and send its logs to an external server so a root-level attacker cannot quietly rewrite the only copy.
Our hardening work covers the update settings, management exposure and log forwarding on mail gateways, and our security operations team can run the compromise checks and review external logs with you. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Cisco security advisory, CVE-2026-76519, Cisco hardening release advisory, September 2026, Cisco security advisory, CVE-2026-76461, The Hacker News, RedLegg, Security Affairs, The Hacker News, UAT-9686, HivePro, CVE-2025-20393.