Advanced Malware Protection (Product): news timeline & CVEs

CISA Warns of Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2026-76519)

CISA says actively exploited Cisco Secure Email Gateway flaw CVE-2026-76519 allows root command execution.

Cisco disclosed CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway's Advanced Malware Protection file-reputation handling that lets an attacker write arbitrary files and run commands as root by sending a crafted email attachment. It affects physical and virtual gateways on vulnerable AsyncOS when file reputation is assigned to a mail policy and Content Scanner Tools are older than 25.3.0.5525. Fixed releases are 15.5.5-014 and 16.5.0-780; release 16.0 has no fix and must be migrated. CISA added the bug to the Known Exploited Vulnerabilities Catalog and told agencies to patch before October 17, 2026. Qualys detection is QID 317944.

Qualys ThreatPROTECTupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 13:38 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-765191

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to write files and run commands as root.

Cisco confirmed attackers are exploiting CVE-2026-76519, a CVSS 9.8 flaw in the Advanced Malware Protection file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root when File Reputation is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Updating the scanner does not require a product restart; AsyncOS fixes are 15.5.5-014 and 16.5.0-780, while 16.0 has no fix. Cisco-managed Secure Email Cloud is already protected. Cisco says this is the third exploited email-gateway root flaw since December 2025 and warns attackers may hide evidence, so external firewall and network logs should be checked.

Security Affairsupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 09:27 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco says attackers are exploiting critical unauthenticated CVE-2026-76519 in Secure Email Gateway for root access.

Cisco warned that CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway Advanced Malware Protection is under active exploitation. Unauthenticated attackers can send crafted attachments, when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525, to write arbitrary files and run commands as root. Fixes released September 14 in versions 15.5.5-014 and 16.5.0-780 were originally grouped under CVE-2026-76440. CISA added the flaw to KEV with an October 17 federal deadline; it follows exploited CVE-2026-76461.

SecurityWeekupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 06:34 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-76519 CVE-2026-76440 CVE-2026-76461

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

Actively exploited CVE-2026-76519 lets unauthenticated attackers gain root on Cisco Secure Email Gateway.

CERT-EU republished Cisco’s advisory for CVE-2026-76519, a CVSS 9.8 relative path traversal in the AMP file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root. Cisco PSIRT says exploitation is active, and compromised cluster SSH keys could expose other members. Affected AsyncOS lines are 15.5 before 15.5.5-014, all 16.0, and 16.5 before 16.5.0-780 when Content Scanner Tools is older than 25.3.0.5525.

CERT-EU Advisoriesupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 00:00 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-765192· 1 read

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

Cisco Secure Email Gateway flaw lets unauthenticated attackers write files and run root commands via crafted attachments.

Cisco says a flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway allows an unauthenticated remote attacker to write arbitrary files when the file reputation service is enabled. A crafted email attachment can lead to arbitrary file writes and command execution with root privileges on the underlying operating system. Cisco has released software updates and states there are no workarounds. The advisory text does not name a CVE or report exploitation in the wild.

Cisco Security Advisoriesupdated Oct 15, 15:12 UTC · 1d agofirst Oct 14, 16:00 UTC · 2d agoVulnerability 12 sources1

Advanced Malware Protection

Timeline5 articles

Related CVEsby mentions

Appears with

CISA Warns of Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2026-76519)

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Cisco Warns of Exploited Secure Email Gateway Vulnerability

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

Cisco Secure Email Gateway Arbitrary File Write Vulnerability