CVE-2026-76519

What is Cisco Secure Email Gateway?

Cisco Secure Email Gateway, formerly IronPort and later the Email Security Appliance, is a mail-filtering appliance that sits in front of an organization's mail infrastructure. Every inbound message passes through it for spam scoring, policy enforcement, URL rewriting, and malware analysis before reaching user mailboxes. Advanced Malware Protection (AMP) is the component that inspects attachments, and its File Reputation service submits file characteristics to Cisco's cloud for a verdict.

The appliance is an unusually attractive target because of where it sits and what it must accept. It is reachable from the internet by design, it accepts unauthenticated input from any sender on the planet, and it processes hostile file formats as its core function. It also holds mail flow in cleartext and stores the credentials and certificates used to talk to directory services and downstream mail servers. Shadowserver tracks close to 300 internet-exposed Secure Email Gateway instances.

Overview

CVE-2026-76519 is a relative path traversal in the AMP attachment-handling code, rated 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and tracked by Cisco as bug CSCwu56223. An unauthenticated remote attacker who simply sends an email with a crafted attachment to an affected appliance can write arbitrary files to the underlying operating system, and Cisco states that successful exploitation can lead to command execution with root privileges.

Cisco published the advisory on 2026-10-14 at 16:00 GMT and confirmed that its PSIRT became aware of active exploitation in October 2026, making this a zero-day. CISA added it to the KEV catalog the same day, in a batch of four. Cisco has not said how many devices were attacked, who is behind the activity, or whether root was confirmed on any victim appliance, and no vendor or researcher has attributed the campaign to a named threat actor.

This is the third root-level flaw in these appliances that Cisco has confirmed as exploited within a year. CVE-2025-20393, a spam quarantine zero-day attributed to the China-linked group UAT-9686, was patched in January 2026, and CVE-2026-76461, an email-parsing SQL injection allowing unauthenticated root command execution, was added to KEV in September 2026. Cisco has not linked the current activity to either. Cisco has also updated its September 2026 Secure Email hardening advisory (cisco-sa-hardening-esa-dfCrfXkm) to note that two issues covered there are under active exploitation, this file write being one of them.

Affected Versions

An appliance is vulnerable only when both conditions hold: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525. Note that AsyncOS 16.0.4-302, which fixed the September hardening issues, does not cover this one.

Technical Details

The CWE is CWE-23, relative path traversal. The code that handles an attachment under AMP file reputation processing builds a filesystem path from attacker-influenced input without properly resolving or rejecting ../ sequences, so a crafted attachment can steer the write outside the intended staging directory and land a file anywhere the scanner process can reach. Because that process runs with high privilege on the appliance, a file placed in the right location converts into command execution as root. Cisco classifies the root cause as improper handling of email attachments when file reputation is enabled; VulDB categorises the same issue as file inclusion under CWE-73, a difference in taxonomy rather than substance.

The attack characteristics are what make this urgent. No authentication, no credentials, and no user interaction are required: the victim does not need to open or even see the message, because the appliance processes the attachment during delivery. Complexity is low and the trigger is a single email through the normal mail path, which means standard perimeter controls that restrict administrative access do nothing to prevent it. There is no workaround.

Discovery

Cisco credits no external researcher. The advisory states the vulnerability "was found during internal security scanning", so Cisco found the flaw itself and then discovered that attackers had reached it first. Cisco PSIRT learned of active exploitation during October 2026 and shipped the fix, the advisory, and a compromise-detection capability together on 2026-10-14. No independent research write-up with exploitation analysis has been published, which is a meaningful gap: defenders currently have only the vendor's account.

Exploitation Context

Cisco confirms exploitation in the wild but has withheld detail. There is no public victim count, no attribution, no exploitation start date beyond "October 2026", and no public proof-of-concept. Cisco did publish a detection mechanism rather than conventional indicators: the appliance performs an internal security scan and writes the result to its system logs. Running grep "System Security" system_logs returns one of four messages, including "Suspected compromise indicator was found. Contact TAC for further recommendations", "Compromise detected. Follow the instructions in the Recommendations section of this Security Advisory", "Security scan did not complete", or "No compromise indicator was found". Clustered deployments must be checked on every member.

Cisco explicitly warns that a clean result is not proof of safety, because an attacker with root can hide evidence on the device. It recommends cross-checking firewall and network logs for unexpected uploads to external addresses or downloads from suspicious ones. Cisco has deployed mitigations across its cloud instances and has proactively contacted Secure Email Cloud customers where it found possible compromise. Cisco Secure Email Cloud administrators without CLI access may be unable to run the check themselves. The absence of file hashes, attacker IP addresses, or payload names in a KEV-listed critical vulnerability is a notable constraint on independent hunting.

Remediation

1. Update Content Scanner Tools to 25.3.0.5525 or later. This is the fastest path: it requires no software upgrade and no restart. Run contentscannerupdate at the CLI for a manual update, or enable automatic updates under Security Services > Service Updates and commit the change.
2. Confirm your exposure first with contentscannerstatus at the CLI, and check whether Enable File Reputation is ticked under Mail Policies > Incoming (or Outgoing) Mail Policies > Advanced Malware Protection. A version earlier than 25.3.0.5525 with file reputation enabled means vulnerable.
3. Upgrade AsyncOS to a fixed release: 15.5.5-014 on the 15.5 line or 16.5.0-780 on 16.5. Appliances on 16.0 have no fixed build in that train and must migrate to 16.5.0-780. No workaround exists.
4. Run the compromise check: grep "System Security" system_logs, on every member of a cluster. Treat "suspected compromise indicator" or "compromise detected" as an incident.
5. Preserve forensic data and logs before upgrading a suspect appliance, because the upgrade destroys them.
6. If a virtual appliance is compromised, deploy a new VM on a fixed release and rebuild the configuration by hand rather than importing the previous configuration file, then renew credentials and cryptographic material. For physical appliances, contact Cisco TAC and ensure remote access is enabled.
7. If any cluster member is compromised, restore every member to a secure configuration. The private SSH keys that cluster members use to authenticate to each other must be assumed exposed.
8. Apply the standing hardening guidance: restrict internet access to the appliance, disable HTTP for the administrator portal, disable unneeded services such as HTTP and FTP, use SAML or LDAP authentication, change default administrator passwords, and forward logs to an external server so that an attacker with root cannot erase them.
9. Federal civilian agencies must remediate by 2026-10-17 under BOD 26-04 and complete the forensic triage the directive requires.