CISA Warns of Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2026-76519)
CISA says actively exploited Cisco Secure Email Gateway flaw CVE-2026-76519 allows root command execution.
Cisco disclosed CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway's Advanced Malware Protection file-reputation handling that lets an attacker write arbitrary files and run commands as root by sending a crafted email attachment. It affects physical and virtual gateways on vulnerable AsyncOS when file reputation is assigned to a mail policy and Content Scanner Tools are older than 25.3.0.5525. Fixed releases are 15.5.5-014 and 16.5.0-780; release 16.0 has no fix and must be migrated. CISA added the bug to the Known Exploited Vulnerabilities Catalog and told agencies to patch before October 17, 2026. Qualys detection is QID 317944.
- CVE-2026-76519 allows arbitrary file write and root command execution.
- Exploitation needs AMP file reputation enabled and Content Scanner Tools before 25.3.0.5525.
- A crafted email attachment is sufficient to trigger the flaw.
- Fixes include AsyncOS 15.5.5-014 and 16.5.0-780; 16.0 must be migrated.
- CISA added it to KEV and set a patch deadline of October 17, 2026.
Vulnerabilities mentionedAll →
- CVE-2026-765199.82%Relative Path Traversal to Root RCE in Cisco Secure Email Gatewaypublished · Cisco Secure Email Gateway KEV PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article318 words · extracted from threatprotect.qualys.com · click to collapse
Cisco released a security advisory for a critical-severity vulnerability in the Cisco Secure Email Gateway. Tracked as CVE-2026-76519, the vulnerability may allow an attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
CISA acknowledged the active exploitation of the vulnerability by adding it to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch it before October 17, 2026.
Vulnerability Details
The vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway originates from improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment to an affected device. Successful exploitation of the vulnerability could allow an attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, if it is running a vulnerable release of Cisco AsyncOS Software and both of the following conditions are met:
- The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
- The Content Scanner Tools version is earlier than 25.3.0.5525.
Indicator of Compromises
To confirm any attempted exploitation of this vulnerability, users can review the system_logs using the following command:
esa-appliance> grep “System Security” system_logs
Affected and Patched Versions
The vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration.
| Cisco AsyncOS for Cisco Secure Email Gateway Software Release | First Fixed Release |
| 15.5 | 15.5.5-014 |
| 16.0 | Migrate to a fixed release. |
| 16.5 | 16.5.0-780 |
Note: Cisco strongly recommends that users migrate to Release 16.5.0-780.
For more information, please refer to Cisco Security Advisory (cisco-sa-esa-afw-zqYJkjxp).
Qualys Detection
Qualys customers can scan their devices with QID 317944 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.