Cisco has disclosed CVE-2026-76519, a critical arbitrary file write vulnerability in the Advanced Malware Protection (AMP) File Reputation handling of Cisco Secure Email Gateway (SEG). An unauthenticated remote attacker can use it to execute commands as root. Cisco states: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a due date of 2026-10-17 for US federal agencies. The flaw is only exploitable under a specific configuration, and fixes are available. Cisco lists no workarounds.
Technical Information
- Vulnerability: Arbitrary file write in the AMP File Reputation handling of Cisco SEG, which can lead to command execution as root by an unauthenticated remote attacker.
- Weakness: CWE-23 (Relative Path Traversal).
- Severity: CVSS 3.1 base score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is the score Cisco assigned as CNA. NVD has not scored it yet: the record is "Undergoing Analysis" and the NVD API labels Cisco's score "Secondary". CISA's ADP SSVC entry rates exploitation as active, automatable yes, technical impact total.
- Advisory: cisco-sa-esa-afw-zqYJkjxp (bug CSCwu56223), v1.0 Final, published 2026-10-14 19:00 IDT. Cisco says the flaw "was found during internal security scanning."
- Exploitation status: Cisco is the only source confirming exploitation. Cisco does not give an exact date. KEV listing reflects CISA's acceptance of the vendor's evidence; we found no independent third-party exploitation telemetry. No source attributes the activity to any actor, names any victims, or publishes compromise counts. CISA lists known ransomware campaign use as "Unknown".
- Exposure: Shadowserver counted nearly 300 internet-exposed SEG instances (as reported by BleepingComputer). This measures exposure only. It does not mean those instances are compromised, or even vulnerable, since the configuration condition below also has to be met.
- KEV entry: "Cisco Secure Email Gateway Relative Path Traversal Vulnerability", dateAdded 2026-10-14, dueDate 2026-10-17, forensicTriage: Yes. CISA's required action is to apply mitigations according to vendor instructions under BOD 26-04 and its Forensics Triage Requirements, or stop using the product if no mitigations are available.
Note: this is a separate issue from CVE-2026-76461, an earlier SEG SQL injection zero-day that affects all configurations. Cisco does not link the two.
Affected Product Versions
On-prem physical and virtual SEG appliances running a vulnerable AsyncOS release are affected only when both of these are true:
- File Reputation is enabled AND assigned to a mail policy, and
- Content Scanner Tools (CST) is older than 25.3.0.5525.
| Product / state | Status | Fixed build / action |
|---|---|---|
| SEG on-prem (physical/virtual), File Reputation enabled on a mail policy, CST earlier than 25.3.0.5525 | Affected | See rows below |
| SEG with File Reputation not enabled on any mail policy | Not affected (per Cisco's conditions) | — |
| AsyncOS 15.5 | Fixed | 15.5.5-014 |
| AsyncOS 16.0 | No fix on this train | Migrate to a fixed release |
| AsyncOS 16.5 | Fixed | 16.5.0-780 (Cisco recommends releases earlier than 16.5 migrate here) |
| Any licensed and supported AsyncOS release | Fixed by CST | Content Scanner Tools 25.3.0.5525 or later (no upgrade or restart needed; applied by automatic updates, or manually if those are disabled) |
| Secure Email Cloud Gateway | Mitigated by Cisco | No customer action required |
| Secure Email and Web Manager (SEWM) | Not affected (Cisco) | — |
| Secure Web Appliance | Not affected (Cisco) | — |
Conflicting source: The Canadian Centre for Cyber Security bulletin AV26-1042 lists SEWM 15.5 before 15.5.5-006 and 16.5 before 16.5.0-429 as affected. That bulletin appears to cover Cisco's September 2026 hardening release in general. Cisco's advisory states that SEWM is not affected by CVE-2026-76519, and Cisco is the authoritative source here.
How to check exposure (Cisco): Look for the "Enable File Reputation" checkbox on the Incoming and Outgoing Mail Policies > AMP pages, and check the Content Scanner Tools version.
Workaround and Mitigation
Workarounds: Cisco lists none.
Fixes (pick one):
- Upgrade AsyncOS to 15.5.5-014 or 16.5.0-780. AsyncOS 16.0 has no fix, so migrate off it.
- Or update Content Scanner Tools to 25.3.0.5525 or later on any licensed and supported AsyncOS release. If automatic updates are disabled, apply it manually.
Secure Email Cloud Gateway: Customers don't need to do anything. Cisco deployed the fixed Content Scanner Tools and other mitigations. Cisco also directly contacted cloud customers where it identified indicators of possible compromise. Customers Cisco contacted should renew credentials and cryptographic material and restrict access.
If compromise is suspected:
- Preserve evidence BEFORE upgrading. Cisco warns: "Upgrading a compromised instance will destroy forensic data and logs."
- Virtual appliances: Rebuild when possible. Deploy a new VM on a fixed release, rebuild the configuration without importing old configuration files, renew credentials and cryptographic material, and keep monitoring.
- Physical appliances: Contact Cisco TAC and keep remote access enabled.
- Clusters: Cluster members authenticate to each other with SSH key pairs, and those private keys may be accessible on a compromised appliance. Cisco strongly recommends restoring every member of a cluster that contains at least one compromised appliance to a secure configuration.
- Attackers with root access may hide evidence. Cross-check network and firewall logs from outside the device.
No suspected compromise: Apply one of the fixes above and follow Cisco's general hardening guidance.
Indicators of Compromise
Cisco, Talos and CISA have published no network IOCs: no IPs, hashes or domains. No ATT&CK techniques have been sourced from a primary source, and we found no Talos blog post on this CVE.
Cisco has published three on-device result messages from its "System Security" log check. These are status messages, not network indicators. Run the check on every cluster member:
- "Suspected compromise indicator was found"
- "Security scan did not complete"
- "No compromise indicator was found"
What This Means for Your Third-Party Risk Program
Email gateways sit in the path of every message a vendor sends and receives, so a root-level compromise there matters to anyone who shares data with that vendor. The goal is a fast but accurate review. Vendors that don't use Cisco SEG, or use it without File Reputation, may be out of scope, but confirm that with them rather than assuming. For vendors and MSPs running SEG, especially on-prem, send short, targeted questions:
- Do you use Cisco Secure Email Gateway, and is it on-prem (physical or virtual) or Secure Email Cloud?
- Is File Reputation (AMP) enabled and assigned to any mail policy?
- What Content Scanner Tools version are you running (25.3.0.5525 or later?), and what AsyncOS build?
- Have you run Cisco's "System Security" log check on every cluster member and reviewed external network and firewall logs? What was the result?
- Has Cisco contacted you about indicators of possible compromise (cloud customers)?
- If compromise was suspected, did you preserve forensic data, rebuild the appliance, restore every cluster member, and rotate credentials, SSH keys and certificates?
If you'd like help working out which of your vendors run Cisco SEG with File Reputation enabled, book a demo.
Forward this to your TPRM owner: Cisco SEG CVE-2026-76519 (CVSS 9.8, CISA KEV, exploitation confirmed by Cisco) affects on-prem gateways that have File Reputation enabled and Content Scanner Tools older than 25.3.0.5525. Please check which vendors and MSPs run Cisco SEG and send them the six questions above.
