Cisco Secure Email Gateway
CVE-2026-76519: a crafted attachment writes files on Cisco Secure Email Gateway.
A flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway lets an unauthenticated remote attacker write arbitrary files on the underlying operating system by sending an email with a crafted attachment through the device. CISA lists it as exploited.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 14 Oct 2026
- Federal due date 17 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 2.2% in 30 days
- Percentile 82%, scored 29 Oct 2026
- 9.8Critical, (CVSS 3.1)Scored by NVD
- 2.2%EPSS, chance of exploitation in 30 daysPercentile 82%; scored 29 Oct 2026
- 14 OctPublished by NVD14 Oct 2026; record read 15 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| Cisco Secure Email Gateway with File Reputation on and Content Scanner Tools before 25.3.0.5525 | Content Scanner Tools 25.3.0.5525, AsyncOS 15.5.5-014 or 16.5.0-780 |
What to do now
Update Content Scanner Tools and AsyncOS to the fixed builds. The release covering this and the two other products sits in our advisory.
How to check exposure
Exposure depends on one setting: the file reputation service. A gateway with File Reputation enabled and Content Scanner Tools below 25.3.0.5525 is exposed to any sender on the internet. The Content Scanner Tools version prints in the gateway's system administration view beside the AsyncOS version.
The Cisco security advisory cisco-sa-esa-afw-zqYJkjxp, opens in a new tab names the fixed releases per branch. The attack needs nothing from the recipient: the attachment is processed before any mailbox sees it.
Who this reaches in Australia
Cisco email gateways front the mail of Australian universities, hospitals and the larger law and accounting firms. A root file write on the device that reads every inbound attachment is a position in front of the whole organisation's mail.
Under the Essential Eight the fix is patch applications and patch operating systems for an internet-facing service: 48 hours where a working exploit exists. The gateway is exactly the kind of appliance that sits outside the patch tooling that covers laptops and servers.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : NVD record last modified
- : CISA due date for US federal agencies
Questions, answered.
Does the attacker need an account?
No. The flaw is triggered by an attachment in an email passing through the gateway while the file reputation service is enabled. The sender needs no credentials and the recipient needs to do nothing.
Which releases fix CVE-2026-76519?
Content Scanner Tools 25.3.0.5525, and AsyncOS 15.5.5-014 or 16.5.0-780 according to our advisory. The Cisco advisory lists the fixed release for each branch.
Is turning off file reputation a fix?
It removes the exposure at the cost of the protection the feature gives. It is a stopgap until the Content Scanner Tools update lands, and the update is the fix.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-76519NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-76519EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, CISA lists exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS
- 6Vendor reference for CVE-2026-76519: sec.cloudapps.cisco.comcisco.com. terms of use.