Cisco AsyncOS (Product): news timeline & CVEs

CISA Warns of Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2026-76519)

CISA says actively exploited Cisco Secure Email Gateway flaw CVE-2026-76519 allows root command execution.

Cisco disclosed CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway's Advanced Malware Protection file-reputation handling that lets an attacker write arbitrary files and run commands as root by sending a crafted email attachment. It affects physical and virtual gateways on vulnerable AsyncOS when file reputation is assigned to a mail policy and Content Scanner Tools are older than 25.3.0.5525. Fixed releases are 15.5.5-014 and 16.5.0-780; release 16.0 has no fix and must be migrated. CISA added the bug to the Known Exploited Vulnerabilities Catalog and told agencies to patch before October 17, 2026. Qualys detection is QID 317944.

Qualys ThreatPROTECTupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 13:38 UTC · 1d agoExploit / PoC in the wild 12 sources CVE-2026-765191

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

Actively exploited CVE-2026-76519 lets unauthenticated attackers gain root on Cisco Secure Email Gateway.

CERT-EU republished Cisco’s advisory for CVE-2026-76519, a CVSS 9.8 relative path traversal in the AMP file-reputation feature of Cisco Secure Email Gateway. An unauthenticated attacker can send a crafted attachment, write arbitrary files, and execute commands as root. Cisco PSIRT says exploitation is active, and compromised cluster SSH keys could expose other members. Affected AsyncOS lines are 15.5 before 15.5.5-014, all 16.0, and 16.5 before 16.5.0-780 when Content Scanner Tools is older than 25.3.0.5525.

CERT-EU Advisoriesupdated Oct 15, 15:12 UTC · 1d agofirst Oct 15, 00:00 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-765192· 1 read

Cisco make-me-root email bug exploited as a 0-day by unknown crims

Attackers are exploiting Cisco Secure Email Gateway zero-day CVE-2026-76519 for unauthenticated root access via email.

Cisco and CISA warned that CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway, was exploited as a zero-day before a fix. Unauthenticated attackers can send a malicious email attachment and, when Advanced Malware Protection File Reputation is enabled and Content Scanner Tools are older than 25.3.0.5525, write files and execute commands as root on physical or virtual AsyncOS appliances. Cisco says a limited number of customers are affected, there is no workaround, and vulnerable releases should move to fixed software, with pre-16.5 systems migrated to 16.5.0-780. CISA added the bug to the KEV catalog with a Saturday federal deadline. It follows exploited SEG flaws CVE-2026-76461 and CVE-2025-20393.

The Register · Securityupdated Oct 15, 15:12 UTC · 1d agofirst Oct 14, 21:40 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-76461

Cisco security advisory (AV26-1042) – Update 1

Cisco says CVE-2026-76519 in Secure Email Gateway is exploited and now on CISA’s KEV list.

The Canadian Centre for Cyber Security updated advisory AV26-1042 on 14 October 2026 for Cisco AsyncOS vulnerabilities in Secure Email Gateway and Secure Email and Web Manager. Affected 15.5 and 16.5 releases need the listed fixes, including Secure Email Gateway 15.5.5-014 and 16.5.0-780. Cisco says CVE-2026-76519, an arbitrary file write in Secure Email Gateway, is being exploited. CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities catalog the same day.

Canadian Centre for Cyber Securityupdated Oct 15, 15:12 UTC · 1d agofirst Oct 14, 20:00 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-765192· 1 read

Cisco patches new Secure Email Gateway zero-day exploited in attacks

Cisco patched actively exploited Secure Email Gateway zero-day CVE-2026-76519 enabling unauthenticated root execution.

Cisco patched CVE-2026-76519, a relative path traversal in Secure Email Gateway Advanced Malware Protection that lets unauthenticated remote attackers write arbitrary files and execute root commands by sending a crafted email attachment. Vulnerable instances have File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Cisco said exploitation was observed in October 2026, published compromise indicators, deployed cloud mitigations, and contacted some Secure Email Cloud owners. Shadowserver tracks nearly 300 exposed SEG instances. The report also cites earlier SEG flaws CVE-2024-20401, CVE-2025-20393, and CVE-2026-76461.

BleepingComputerupdated Oct 15, 15:12 UTC · 1d agofirst Oct 14, 17:29 UTC · 2d agoExploit / PoC in the wild 12 sources CVE-2026-76519

Cisco AsyncOS

Timeline5 articles

Related CVEsby mentions

Appears with

CISA Warns of Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2026-76519)

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

Cisco make-me-root email bug exploited as a 0-day by unknown crims

Cisco security advisory (AV26-1042) – Update 1

Cisco patches new Secure Email Gateway zero-day exploited in attacks