CVE-2026-76519: Cisco Secure Email Gateway Zero-Day Grants Root via Crafted Attachment

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets them take full control of
the appliance simply by sending an email with a booby-trapped attachment. It affects gateways that
scan attachments with Cisco’s file reputation service, and there is no workaround. Organisations using
Cisco Secure Email Gateway should check for signs of compromise and install Cisco’s fixed scanner
update and software now.

1. Vulnerability Details

CVE ID- CVE-2026-76519
CVSS SCORE- 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EXPLOIT STATUS- Active exploitation confirmed by Cisco PSIRT (October 2026)

CWE-23: Relative Path Traversal. The Advanced Malware Protection (AMP) feature mishandles email attachments when
the File Reputation service is enabled. An unauthenticated attacker sends an email with a crafted attachment through the
gateway to write arbitrary files and run commands as root. Physical and virtual gateways are affected when File
Reputation is assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Secure Email and Web
Manager and Secure Web Appliance are not affected.

2. Affected Products & Fixed Versions

3. Observed Activity

Cisco found the flaw through internal security scanning and has not named an attacker or shared attack details.

• Exploitation status: Cisco PSIRT became aware of active exploitation in October 2026. Root access lets attackers remove evidence on the appliance, so Cisco advises checking firewall and network logs for unexpected uploads from the gateway to external IP addresses.
• Secure Email Cloud: Cisco has deployed the fixed Content Scanner Tools to its cloud gateways and directly contacted cloud customers where it found signs of compromise; those customers should renew credentials and cryptographic material.
• Cluster risk: Clustered gateways authenticate with SSH key pairs. A compromised appliance can expose these private keys, so Cisco recommends restoring every member of a cluster that contains a compromised gateway.
• Repeat targeting: This is the second exploited Secure Email Gateway zero-day in two months, after CVE-2026-76461 in September 2026. Shadowserver tracks nearly 300 gateways exposed online.

4. Indicators of Compromise (IOCs)

• Run on each appliance and cluster member: grep “System Security” system_logs
• “System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.” Compromise detected; follow Cisco’s restoration steps.
• “System Security: Security scan did not complete. Contact TAC for further recommendations.” Contact Cisco TAC.
• “System Security: No compromise indicator was found.” No compromise detected; upgrade to a fixed release.

5. Recommendations

• Identify Secure Email Gateways with File Reputation enabled on any mail policy, and run contentscannerstatus to find those on Content Scanner Tools earlier than 25.3.0.5525.
• Run grep “System Security” system_logs on every appliance and cluster member, and check firewall logs for unexpected uploads from the gateway to external IP addresses.
• Update Content Scanner Tools to 25.3.0.5525 with contentscannerupdate or enable automatic updates, then upgrade AsyncOS to 15.5.5-014 or 16.5.0-780.
• If compromised, save forensic data before upgrading; rebuild virtual gateways on a new VM without importing old configuration, renew credentials and certificates, restore every cluster member, and contact Cisco TAC for physical appliances.
• Allow management access only from trusted hosts, separate mail and management onto different interfaces, and send appliance logs to an external server.

6. Sources

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esaafw-zqYJkjxp
• https://www.strix.ai/cve/CVE-2026-76519

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.