CVE-2026-76519 is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment that the gateway mishandles. A successful attack can write arbitrary files on the underlying operating system and execute commands as root. Cisco Secure Email Gateway deployments that use this AMP/file reputation feature are affected; specific version ranges are not listed in the source data. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14, Cisco has urged customers to patch and check for compromise, and a public proof-of-concept reference exists; ransomware use is listed as unknown.
What to do: Apply Cisco's fixes or mitigations for CVE-2026-76519 immediately, and follow CISA BOD 26-04 (including forensics triage). Treat appliances with Advanced Malware Protection or file reputation enabled as potentially compromised: review for unexpected files and root-level command execution, and isolate or discontinue use if a vendor fix is unavailable.
Affected
Cisco Secure Email Gateway
—
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
CISA Known Exploited Vulnerability
Affected
Cisco Secure Email Gateway
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA added exploited Palo Alto, Cisco, and Ahsay flaws to KEV, with a three-day federal deadline.
CISA added four actively exploited vulnerabilities to the KEV catalog and gave U.S. federal civilian agencies until October 17, 2026, to remediate them. CVE-2026-0322 is an authenticated PAN-OS management-interface flaw, CVSS 8.6, that yields root code execution on PA-Series, VM-Series, and Panorama; Palo Alto reports very limited exploitation. CVE-2026-76519 is a CVSS 9.8 path-traversal bug in Cisco Secure Email Gateway’s AMP file-reputation feature that lets a crafted attachment write files and run commands as root. CVE-2026-105133 and CVE-2026-105134 in AhsayCBS are chained for authentication bypass and SYSTEM-level command injection; Huntress observed webshells and cryptominers, and Ahsay said earlier patches were incomplete.
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to fix them by October 17, 2026. CVE-2026-76519 (CVSS 9.8) is a relative path traversal in Cisco Secure Email Gateway that Cisco says is exploited by crafted email attachments that write arbitrary files. CVE-2026-0322 (CVSS 8.6) is authenticated code injection in the PAN-OS management interface, with limited exploitation observed on PA-Series, VM-Series, and Panorama. AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 were chained from October 7 for authentication bypass and unauthenticated command injection, deploying JSP webshells and XMRig miners against at least five organizations.
Cisco says attackers are exploiting critical unauthenticated CVE-2026-76519 in Secure Email Gateway for root access.
Cisco warned that CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway Advanced Malware Protection is under active exploitation. Unauthenticated attackers can send crafted attachments, when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, to write arbitrary files and run commands as root. Fixes released September 14 in versions 15.5.5-014 and 16.5.0-780 were originally grouped under CVE-2026-76440. CISA added the flaw to KEV with an October 17 federal deadline; it follows exploited CVE-2026-76461.
Cisco and Palo Alto patched two actively exploited zero-days enabling root code execution on email and PAN-OS appliances.
Cisco and Palo Alto Networks patched two actively exploited zero-days that can lead to root-level code execution on security appliances, and CISA added both to the KEV catalog. CVE-2026-76519 in Cisco Secure Email Gateway can be exploited remotely without authentication through malicious email attachments. CVE-2026-0322 in the PAN-OS management interface requires network access and valid high-privilege credentials. Both need urgent remediation, but their exposure conditions differ.
Cisco disclosed CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway's Advanced Malware Protection file-reputation handling that lets an attacker write arbitrary files and run commands as root by sending a crafted email attachment. It affects physical and virtual gateways on vulnerable AsyncOS when file reputation is assigned to a mail policy and Content Scanner Tools are older than 25.3.0.5525. Fixed releases are 15.5.5-014 and 16.5.0-780; release 16.0 has no fix and must be migrated. CISA added the bug to the Known Exploited Vulnerabilities Catalog and told agencies to patch before October 17, 2026. Qualys detection is QID 317944.
Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to run root commands via crafted attachments.
Cisco confirmed active exploitation of CVE-2026-76519 in physical and virtual Secure Email Gateway appliances running vulnerable AsyncOS. When File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, a specially crafted email attachment can write arbitrary files and execute commands as root. Fixed releases are AsyncOS 15.5.5-014 and 16.5.0-780; customers on 16.0 should migrate, and Content Scanner Tools 25.3.0.5525 can be updated without a restart. Cisco said attackers could obtain cluster SSH keys and hide evidence, and it has already updated Secure Email Cloud Gateway. No victim count or attacker identity was disclosed.
Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to write files and run commands as root.
Cisco confirmed attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in the Advanced Malware Protection file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root when File Reputation is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Updating the scanner does not require a product restart; AsyncOS fixes are 15.5.5-014 and 16.5.0-780, while 16.0 has no fix. Cisco-managed Secure Email Cloud is already protected. Cisco says this is the third exploited email-gateway root flaw since December 2025 and warns attackers may hide evidence, so external firewall and network logs should be checked.
Actively exploited CVE-2026-76519 lets unauthenticated attackers gain root on Cisco Secure Email Gateway.
CERT-EU republished Cisco’s advisory for CVE-2026-76519, a CVSS 9.8 relative path traversal in the AMP file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root. Cisco PSIRT says exploitation is active, and compromised cluster SSH keys could expose other members. Affected AsyncOS lines are 15.5 before 15.5.5-014, all 16.0, and 16.5 before 16.5.0-780 when Content Scanner Tools is older than 25.3.0.5525.
Cisco says attackers are exploiting critical Secure Email Gateway flaw CVE-2026-76519 to write files and gain root.
Cisco said attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway. An unauthenticated sender can email a crafted attachment, write files to the appliance operating system, and potentially run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped in AsyncOS 15.5.5-014 and 16.5.0-780, or Content Scanner Tools 25.3.0.5525 and later; release 16.0 has no fixed build. Cisco contacted managed Secure Email Cloud customers showing possible compromise indicators. Separately, September's SQL-injection flaw CVE-2026-76461 was exploited and added to CISA's KEV catalog.
Cisco patched CVE-2026-76519, a relative path traversal in Secure Email Gateway Advanced Malware Protection that lets unauthenticated remote attackers write arbitrary files and execute root commands by sending a crafted email attachment. Vulnerable instances have File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Cisco said exploitation was observed in October 2026, published compromise indicators, deployed cloud mitigations, and contacted some Secure Email Cloud owners. Shadowserver tracks nearly 300 exposed SEG instances. The report also cites earlier SEG flaws CVE-2024-20401, CVE-2025-20393, and CVE-2026-76461.
Palo Alto patches exploited PAN-OS management RCE CVE-2026-0322; CISA set an October 17 deadline.
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), an authenticated remote code execution flaw in the PAN-OS management interface that lets an attacker with network access run code as root. PA-Series, VM-Series, and Panorama are affected; Cloud NGFW and Prisma Access are not. The company said exploitation has been very limited and tied attempts to three U.S. IP addresses. CISA added CVE-2026-0322 and Cisco Secure Email Gateway flaw CVE-2026-76519 to KEV, with a federal patch deadline of October 17, 2026.
CISA added four actively exploited flaws in PAN-OS, Cisco Secure Email Gateway, and AhsayCBS to KEV.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. They are CVE-2026-0322, a Palo Alto Networks PAN-OS code injection flaw; CVE-2026-76519, a Cisco Secure Email Gateway relative path traversal flaw; and CVE-2026-105133 and CVE-2026-105134, improper authentication and command injection in Ahsay AhsayCBS. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV entries, especially on exposed assets that can be fully controlled after exploitation.
Cisco says CVE-2026-76519 in Secure Email Gateway is exploited and now on CISA’s KEV list.
The Canadian Centre for Cyber Security updated advisory AV26-1042 on 14 October 2026 for Cisco AsyncOS vulnerabilities in Secure Email Gateway and Secure Email and Web Manager. Affected 15.5 and 16.5 releases need the listed fixes, including Secure Email Gateway 15.5.5-014 and 16.5.0-780. Cisco says CVE-2026-76519, an arbitrary file write in Secure Email Gateway, is being exploited. CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities catalog the same day.