CVE-2026-76519: Cisco Secure Email Gateway Arbitrary File Write
CVE-2026-76519 is a critical path-traversal vulnerability in Cisco Secure Email Gateway's Advanced Malware Protection (AMP) attachment handling. An unauthenticated remote attacker can send a crafted email attachment through a vulnerable gateway to write arbitrary files and potentially execute commands as root. Exploitation is active. Apply the fixed Content Scanner Tools package or upgrade immediately.
Impacted systems
| Software / application | Version / scope |
|---|---|
| Cisco Secure Email Gateway (physical and virtual appliances) running Cisco AsyncOS | Affected when File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Fixed in Content Scanner Tools 25.3.0.5525 or later. Fixed software releases: AsyncOS 15.5.5-014 for 15.5; AsyncOS 16.5.0-780 for 16.5. For 16.0, migrate to a fixed release. |
Exploitation conditions
The gateway must have AMP File Reputation enabled and assigned to a mail policy, and Content Scanner Tools must be earlier than 25.3.0.5525. An unauthenticated remote attacker sends an email containing a crafted attachment through the affected appliance. Successful exploitation can write arbitrary files and execute commands with root privileges. Active exploitation was identified in October 2026.
Recommended action
- Check whether File Reputation is enabled for incoming or outgoing mail policies and check the Content Scanner Tools version with `contentscannerstatus`.
- Update Content Scanner Tools to version 25.3.0.5525 or later. If a manual update is required, run `contentscannerupdate`; automatic updates may already have installed the fix.
- Upgrade to AsyncOS 15.5.5-014 or later in the 15.5 train, or 16.5.0-780 or later in the 16.5 train. For 16.0, migrate to a fixed release and follow Cisco's supported upgrade path.
- Search `system_logs` on every appliance and cluster member for the System Security messages listed in the IOCs section. Review external firewall and network logs for unexpected uploads or downloads.
- If compromise is suspected, preserve forensic data before upgrading or rebuilding and contact Cisco TAC. For virtual appliances, deploy a clean fixed instance, rebuild configuration without importing old configuration files, and renew credentials and cryptographic material.
- If one cluster member is compromised, assess and restore every member because inter-member SSH private keys may be exposed. Monitor anomalous activity and restrict appliance access to trusted hosts.
Workarounds
No workaround addresses this vulnerability. Apply the fixed Content Scanner Tools package or upgrade to a fixed AsyncOS release as soon as possible.
As temporary risk reduction, restrict appliance access to trusted hosts, filter management traffic through firewalls, and monitor appliance traffic externally. These controls do not fix the vulnerability.
Indicators of compromise
Log Search
grep "System Security" system_logs
run on each appliance and cluster member
Log Message
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.
treat as compromise detected
System Security: Security scan did not complete. Contact TAC for further recommendations.
contact Cisco TAC
System Security: No compromise indicator was found.
does not rule out compromise; root access may allow evidence to be removed or hidden