Cisco Secure Email Gateway Path Traversal Flaw Exploited to Gain Root Access
Cisco confirmed that attackers are exploiting CVE-2026-76519, a critical flaw in the gateway's attachment scanning that lets one crafted email write files and run commands as root.
AegisAI Threat IntelligenceAegisAI Threat Watch · Mail gateway vulnerability
Cisco Secure Email Gateway Path Traversal Flaw Exploited to Gain Root Access
Cisco confirmed that attackers are exploiting CVE-2026-76519, a critical flaw in the gateway's attachment scanning that lets one crafted email write files and run commands as root.
Analysis based on Cisco's security advisory, 14 Oct 2026.
Cisco has confirmed that attackers are exploiting CVE-2026-76519, a critical flaw in the attachment-scanning feature of Cisco Secure Email Gateway. According to the advisory, an unauthenticated remote attacker who sends an email with a crafted attachment through a vulnerable gateway can write arbitrary files to the underlying operating system and run commands as root.
Cisco published the advisory on 14 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day. Only gateways with File Reputation enabled and assigned to a mail policy, and with Content Scanner Tools earlier than 25.3.0.5525, are exposed. Cisco lists no workaround.
Sources: Cisco advisory; CISA KEV entry; BleepingComputer for the exposure count.
Key judgments
- The exposed component is the attachment scanner itself. The flaw sits in the feature that inspects attachments and checks their reputation, so the message that triggers it is an ordinary-looking email with one crafted file.
- Exposure needs two conditions together. File Reputation must be enabled and assigned to a mail policy, and Content Scanner Tools must be earlier than 25.3.0.5525. A gateway missing either condition is not exposed to this flaw.
- There is no workaround, so the update is the control. Cisco's fix is Content Scanner Tools 25.3.0.5525 or later, or a fixed AsyncOS release.
- A clean check is not proof of safety. Attackers with root can remove or hide evidence, which is why Cisco points to network and firewall logs held outside the appliance.
The flaw sits in attachment scanning
What Cisco says is affected
Cisco describes CVE-2026-76519 as a relative path traversal weakness (CWE-23) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. The specific component is the File Reputation service. The advisory is titled "Cisco Secure Email Gateway Arbitrary File Write Vulnerability" and carries a CVSS 3.1 base score of 9.8.
One email, no login
The advisory says the attacker needs no authentication. Sending an email with a crafted attachment through an affected device is enough to write arbitrary files on the underlying operating system and to execute commands with root privileges. Cisco's PSIRT became aware of active exploitation in October 2026.
Two conditions decide exposure
A gateway is vulnerable only when both of these are true: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. Each condition can be checked directly. The installed scanner version comes from the contentscannerstatus command. The File Reputation setting sits under Mail Policies, then Incoming (or Outgoing) Mail Policies, then Advanced Malware Protection, in the "Enable File Reputation" option.
Cisco states that Content Scanner Tools 25.3.0.5525 and later contain the fix and install on supported AsyncOS releases without a restart. For the AsyncOS releases themselves, the fixed builds are 15.5.5-014 and 16.5.0-780. For release 16.0, Cisco's guidance is to migrate to a fixed release.
The scanner that decides whether an attachment is safe is also the part an attacker can reach with one.
AegisAI Threat IntelligenceThis is the second exploited gateway flaw in about a month
Cisco's advisory for CVE-2026-76461, a SQL injection flaw (CWE-89, CVSS 9.8), was published on 14 September 2026, and Cisco says it learned of exploitation in September. CVE-2026-76519 followed in October. The two were disclosed a month apart.
The fixed AsyncOS builds for CVE-2026-76519, 15.5.5-014 and 16.5.0-780, first shipped on 14 September in Cisco's September 2026 security hardening release. That advisory lists five other CVEs, not CVE-2026-76519, and Cisco's 14 October update to it says two of the five are known to be exploited. Cisco does not say whether any of those is the same bug as CVE-2026-76519.
An earlier case shows the same appliance family under pressure. CVE-2025-20393, a CVSS 10.0 flaw in the Spam Quarantine feature, affected Secure Email Gateway and Secure Email and Web Manager when Spam Quarantine was exposed to the internet. Cisco's advisory for it was updated with fixed releases on 15 January 2026.
What the advisory asks defenders to do
Cisco's compromise check is a single command on the appliance, grep "System Security" system_logs, run on every member of a cluster. It returns one of three messages: a suspected compromise indicator found, a security scan that did not complete, or no compromise indicator found. Cisco also recommends cross-checking network logs and firewall logs outside the impacted device for unexpected transfers to external IP addresses.
If a virtual appliance shows signs of compromise, Cisco's steps are to preserve forensic data first, because an upgrade destroys it, then deploy a new VM on a fixed release, rebuild the configuration without importing old files, and renew credentials and cryptographic material. Every member of a cluster that contains a compromised appliance is restored. For a physical appliance, Cisco recommends contacting its Technical Assistance Center and keeping remote access enabled to speed the investigation.
What to watch in mail flow
Patching closes the flaw, but a gateway that was exposed before the update leaves open questions about the period before it. Three checks are practical. First, record which gateways have File Reputation assigned to a mail policy and which scanner version each reports, so that exposure is a known list and not an assumption. Second, keep a copy of gateway logs on a system the gateway cannot write to, since Cisco warns that root access can hide evidence on the device. Third, review outbound connections from the appliance for destinations that are not Cisco services or the organization's own infrastructure.
These are routine hygiene steps that follow Cisco's own guidance and apply to any internet-facing mail system.
What the reporting does not tell us
Scale. Cisco has not published how many appliances were attacked or whether attackers obtained root on any of them. A Cisco spokesperson, quoted by The Register, said only that it is aware of active exploitation.
Attribution. No source identifies who is behind the exploitation.
Exposure count. The figure of nearly 300 comes from BleepingComputer citing Shadowserver. It counts gateways visible online, not gateways confirmed vulnerable or compromised, and the Shadowserver figure could not be checked directly.
Relation to the September hardening release. Cisco does not state whether any CVE in that release is the same flaw as CVE-2026-76519.
MITRE ATT&CK mapping
| ID | Name | Use in this campaign |
|---|---|---|
T1190 | Exploit Public-Facing Application | An unauthenticated remote attacker sends a crafted attachment through a vulnerable Secure Email Gateway to trigger the path traversal file write. |
T1070 | Indicator Removal | Attackers with root may remove or hide evidence on the appliance, which is why Cisco advises checking logs outside the device. |
Indicators of compromise
| Indicator | Type | Note |
|---|---|---|
CVE-2026-76519 | Vulnerability ID | Relative path traversal (CWE-23), CVSS 9.8, in the Secure Email Gateway Advanced Malware Protection feature. Actively exploited. |
Content Scanner Tools earlier than 25.3.0.5525 | Version condition | Vulnerable when File Reputation is also enabled and assigned to a mail policy. |
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations. | Log string | Result of Cisco's grep "System Security" system_logs check that indicates suspected compromise. |
System Security: Security scan did not complete. Contact TAC for further recommendations. | Log string | The check could not finish, so the result is inconclusive. |
CVE-2026-76461 | Vulnerability ID | Related Secure Email Gateway SQL injection (CWE-89), published 14 September 2026, also exploited. |
These are vulnerability and log indicators published by Cisco. No attacker infrastructure has been published.
Recommendations for defenders
- Update Content Scanner Tools to 25.3.0.5525 or later, which Cisco says installs on supported AsyncOS releases without a restart.
- Move gateways on AsyncOS earlier than 16.5 to 16.5.0-780, or to 15.5.5-014 on the 15.5 branch. Cisco has no fixed build for 16.0 and advises migrating to a fixed release.
- Confirm the scanner version with
contentscannerstatusinstead of assuming an automatic update applied, and confirm whether File Reputation is assigned to a mail policy. - Run
grep "System Security" system_logson every appliance and every cluster member, and cross-check network and firewall logs held outside the device. - If a virtual appliance shows signs of compromise, preserve forensic data first, rebuild on a fixed release without importing the old configuration, and renew credentials and keys. For a physical appliance, contact Cisco TAC.
FAQ
What is CVE-2026-76519?
It is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. Per Cisco's advisory, an unauthenticated remote attacker can send an email with a crafted attachment through an affected device to write arbitrary files and run commands as root.
Is CVE-2026-76519 being exploited?
Yes. Cisco says its PSIRT became aware of active exploitation in October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a due date of 17 October.
Which Secure Email Gateway setups are vulnerable?
Both conditions must hold: the File Reputation service is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525. A gateway that meets only one of them is not exposed to this flaw.
Is there a workaround, and how can an organization check for compromise?
Cisco lists no workaround. The fix is Content Scanner Tools 25.3.0.5525 or later, or a fixed AsyncOS release. To check for compromise, Cisco's command is grep "System Security" system_logs, plus a review of network and firewall logs outside the device. A clean result is not proof of safety, since an attacker with root can hide evidence.
References
- Cisco (14 Oct 2026). Cisco Secure Email Gateway Arbitrary File Write Vulnerability. sec.cloudapps.cisco.com
- Cisco (14 Sep 2026, updated 14 Oct 2026). Security Hardening Release: September 2026. sec.cloudapps.cisco.com
- Cisco (14 Sep 2026). Cisco Secure Email Gateway SQL injection advisory for CVE-2026-76461. sec.cloudapps.cisco.com
- Cisco (updated 15 Jan 2026). Advisory for CVE-2025-20393. cisco.com
- CISA. Known Exploited Vulnerabilities catalog entry for CVE-2026-76519. cisa.gov
- BleepingComputer (14 Oct 2026). Cisco patches new Secure Email Gateway zero-day exploited in attacks. bleepingcomputer.com
- The Register (14 Oct 2026). Cisco make-me-root email bug exploited as a 0-day by unknown crims. theregister.com
- MITRE ATT&CK. T1190, T1070. attack.mitre.org
Related posts
More from the AegisAI blog.