Cisco Secure Email Gateway Arbitrary File Write Vulnerability

In plain language

What this advisory means

Cisco Secure Email Gateway has a critical security flaw in its Advanced Malware Protection feature. An attacker who is not logged in can send a malicious email with a specially crafted attachment that lets them write files anywhere on the server's operating system. This can let them run commands with full administrative privileges. Cisco has issued software updates to fix this issue, but no other workarounds are available.

Technical explanation

How the issue affects the environment

The vulnerability exists in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, specifically when the File Reputation service is enabled. Due to improper handling of email attachments, an unauthenticated remote attacker can send a crafted email attachment that exploits the flaw to write arbitrary files on the underlying operating system. Successful exploitation grants remote code execution with root privileges. The flaw is tracked as CVE-2026-76519 with a CVSS 3.1 base score of 9.8 (critical). The issue affects software releases with Content Scanner Tools prior to version 25.3.0.5525. Cisco has released fixed software versions starting with Cisco AsyncOS 15.5.5-014 and 16.5.0-780, and updating Content Scanner Tools also remediates the vulnerability without requiring a full software upgrade or device restart.

Operational impact

Why teams should care

This vulnerability allows attackers to gain root-level command execution on affected Cisco Secure Email Gateway devices remotely and without authentication. The consequence is a full compromise of the email gateway system, potentially leading to unauthorized data access, disruption of email services, and the attacker hiding trace of their activities. Since this device handles critical email security functions, successful exploitation can have serious organizational impacts including operational downtime, data breaches, and regulatory exposure. Cisco strongly recommends prompt upgrading to fixed software releases to mitigate these risks.

Affected and fixed releases

Temporary risk reduction

There are no workarounds available for this vulnerability. The only effective mitigation is to upgrade to a fixed software release or update the Content Scanner Tools component to the fixed version.

Evidence and validation checklist

• Cisco official security advisory published October 14, 2026
• CVSS 3.1 base score 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected product: Cisco Secure Email Gateway with enabled File Reputation service and vulnerable Content Scanner Tools
• No available workarounds; fix released via AsyncOS updates and Content Scanner Tools updates
• Reported active exploitation by Cisco PSIRT in October 2026
• Instructions for checking compromise indicators via system logs
• Recommendations for remediation including upgrading software and renewing credentials after suspected compromise