Cisco Email Gateway Attachment Flaw Gives Attackers Root Access

An email attachment can give an attacker root access on a vulnerable Cisco Secure Email Gateway. Cisco’s October 14 advisory says attackers are actively exploiting CVE-2026-76519; the company detected malicious activity on some Cisco Secure Email Cloud devices and contacted the affected customers. Physical and virtual gateways need attention too: the vulnerable path runs when File Reputation is assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525.

Cisco describes an unauthenticated sender getting arbitrary file writes and command execution as root by sending a crafted attachment through an affected gateway. Its CVE record scores the flaw 9.8 and classifies it as relative path traversal (CWE-23). Restricting the management interface alone will leave that mail-processing path available to messages traversing the gateway.

Attachment scanning exposes older gateways

The File Reputation service sits in Cisco Advanced Malware Protection (AMP). On each gateway, inspect both Mail Policies > Incoming Mail Policies > Advanced Malware Protection and Mail Policies > Outgoing Mail Policies > Advanced Malware Protection, choose the relevant mail policies, and check Enable File Reputation. Then run contentscannerstatus in the CLI and read the installed Content Scanner Tools version. Cisco’s example of a vulnerable package is 25.2.0.5427.15.5.001. These conditions apply to physical and virtual Secure Email Gateways running vulnerable AsyncOS releases; Cisco lists Secure Email and Web Manager and Secure Web Appliance as unaffected by this specific flaw.

Cisco’s related hardening advisory links this exploited file-write finding to its path-traversal group. Our earlier report on the broader release covers the grouped weaknesses and fixed builds for both email products.

Search every gateway for security signals

Run grep "System Security" system_logs on each gateway in a cluster. Cisco maps System Security: Suspected compromise indicator was found. Contact TAC for further recommendations. to compromise response, System Security: Security scan did not complete. Contact TAC for further recommendations. to a TAC support case, and System Security: No compromise indicator was found. to its upgrade path. Administrators of Cisco Secure Email Cloud without CLI access should work with Cisco; it has contacted customers whose cloud devices showed malicious activity.

Root access gives an intruder room to remove appliance traces. Cross-check externally retained network and firewall logs for unexpected uploads from the gateway to external IP addresses and downloads from malicious IP addresses, as Cisco recommends. Preserve each cluster member’s logs separately. Cisco also warns that private SSH keys used between cluster members may be taken from a compromised gateway, putting its peers at risk.

Update scanners or rebuild compromised devices

For gateways without suspected compromise, bring Content Scanner Tools to 25.3.0.5525 or later and verify with contentscannerstatus. Automatic package updates require a read-back of the installed version; if updates are disabled, Cisco supplies contentscannerupdate for a manual update. The package update needs neither a software upgrade nor a restart. The first fixed AsyncOS releases are 15.5.5-014 on the 15.5 branch and 16.5.0-780 on 16.5; Cisco directs 16.0 users to migrate to a fixed release and recommends 16.5.0-780 for releases earlier than 16.5. Cisco says it has already deployed a fixed scanner package to Secure Email Cloud Gateway infrastructure. The advisory says, “There are no workarounds that address this vulnerability.”

For a suspected compromise on a physical appliance, contact Cisco TAC. For a virtual appliance, preserve forensic data before changing it: Cisco says upgrading a compromised instance destroys logs and forensic material. Deploy a clean VM on a fixed release, reconstruct its configuration without importing old configuration files, renew credentials and cryptographic material, and keep watching for anomalous activity. If one cluster member was compromised, restore each member to a secure configuration because cluster SSH keys may have been exposed. Cloud customers contacted by Cisco should follow its recovery guidance, including credential and cryptographic-material renewal where possible.

Confirm the fixed scanner version on every in-scope gateway, and use external traffic records alongside each appliance’s security messages when deciding whether an update is enough or the gateway must be rebuilt.