2026-017: Critical Vulnerability in Cisco Secure Email Gateway

Critical Vulnerability in Cisco Secure Email Gateway

On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system [1].

The Cisco PSIRT is aware of active exploitation of this vulnerability [1].

CERT-EU strongly recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS Software to a fixed release as soon as possible, prioritising appliances reachable from the internet. CERT-EU also recommends checking all affected appliances for indicators of compromise.

The vulnerability CVE-2026-76519, with a CVSS score of 9.8, is a relative path traversal flaw in the AMP feature of Cisco Secure Email Gateway that allows an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. The vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit it by sending an email that contains a crafted attachment through an affected device, and a successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges [1].

Cisco notes that Secure Email Gateway appliances can be part of clusters, and that private SSH keys used for authentication between cluster members could be accessed on a compromised appliance, which may allow the attacker to compromise other cluster members. Upon successful exploitation, attackers may also remove or hide evidence of exploitation and indicators of compromise [1].

The vulnerability affects Cisco Secure Email Gateway (both physical and virtual) running the following versions of Cisco AsyncOS Software [1]:

The following conditions should also be met [1]: