CVE-2026-76519: Cisco Secure Email Gateway root via one attachment
File Reputation path traversal to root on Cisco SEG

CVE-2026-76519: Cisco Secure Email Gateway root via one attachment

Cisco disclosed CVE-2026-76519 on 14 October 2026. It is a CVSS 9.8 relative path traversal in Secure Email Gateway. An unauthenticated sender can write files and run commands as root if File Reputation is enabled.

What happened

The bug sits in Advanced Malware Protection. Cisco says the gateway mishandles a crafted email attachment when File Reputation is on and assigned to a mail policy. There is no login and no user click.

Cisco PSIRT said it learned of active exploitation in October 2026. CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day. The federal remediation date is 17 October 2026.

Shadowserver is tracking nearly 300 internet-exposed Secure Email Gateway instances. That figure is exposure, not a confirmed victim count.

Who is affected

Physical and virtual Cisco Secure Email Gateway appliances are exposed only when both of these are true:

  • File Reputation is enabled and assigned to an incoming or outgoing mail policy.
  • Content Scanner Tools is older than 25.3.0.5525.

Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco says cloud gateway customers do not need to patch themselves. Cisco has already pushed the scanner-tools fix there and has contacted cloud customers where it saw compromise indicators.

What to do now

Update Content Scanner Tools to 25.3.0.5525 or later, then confirm the version with contentscannerstatus. That update does not require an AsyncOS upgrade or a reboot. If automatic updates are off, run contentscannerupdate.

Also move AsyncOS to a fixed release if you are still on a vulnerable train: 15.5.5-014, or 16.5.0-780. Cisco wants 16.0 customers to migrate rather than stay on that train.

Check system_logs for a suspected-compromise indicator. A clean log line is not proof. Root access can wipe evidence. Compare firewall logs for unexpected uploads leaving the appliance. If a virtual gateway looks compromised, preserve logs, build a new VM on a fixed release, rebuild the config from scratch, and rotate credentials, certificates, and cluster SSH keys. Do not import the old config onto the new box.

Source: Cisco security advisory, cisco-sa-esa-afw-zqYJkjxp.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Linux Vghost CVE-2026-74580 can root a host or hit QEMU
Stale vhost IOTLB cache, local privilege escalation, limited VM escape path