Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76519updated 26 Oct 2026, 11:59 UTC

Cisco Secure Email Gateway flaw lets outsiders write files and run commands

An attacker can send a specially crafted email attachment to the email gateway and take control of the device, without needing a password. Attacks are already happening.

Exploited (CISA KEV, CERT-EU)Fix availableOfficial, 3 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?YesConfirmed by CISA KEV, CERT-EU · 14 Oct 2026
Fix available?YesUpdate the Content Scanner Tools package or upgrade to a fixed Cisco AsyncOS release, per Cisco's advisory. Specific version numbers not stated in the provided material. · since 26 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends emailCrafted attachment sent to the gateway
  2. 2Gateway processes attachmentAMP file reputation enabled, handling flawed
  3. 3Path traversal writeFiles written outside intended directory
  4. 4Command executionCommands run with root privileges
  5. ResultAttacker controls the email appliance as root

What happened

A path traversal flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, triggered when the file reputation service is enabled, lets unauthenticated remote attackers write arbitrary files and execute commands as root.

Why it is dangerous: Successful exploitation gives full root control of the email appliance, which sits in the path of all inbound mail and can be used to read, tamper with, or redirect email. Any organisation running an internet-reachable affected appliance is at risk.

Are you affected?

You are affected if you run Cisco Secure Email Gateway with the AMP feature and file reputation service enabled, especially on an appliance reachable from the internet.

Cisco Secure Email Gateway (AsyncOS) with AMP file reputation enabled; exact affected versions not stated in the provided material.

What to do

  1. Update the Content Scanner Tools package or upgrade Cisco AsyncOS to a fixed release, starting with internet-facing appliances
  2. If you cannot patch, apply the mitigations in Cisco's vendor instructions, or stop using the product if no mitigation exists
  3. Check all affected appliances for indicators of compromise and follow CISA forensics triage requirements
  4. Assess each asset's internet exposure and prioritise patching accordingly

Timeline

  1. 14 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 14 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 26 Oct 2026, 11:59 UTC
    CERT-EU reported on it · CERT-EU
  5. 26 Oct 2026, 11:59 UTC
    Fix: Update the Content Scanner Tools package or upgrade to a fixed Cisco AsyncOS release, per Cisco's advisory. Specific version numbers not stated in the provided material.

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76519 · GHSA-6rc3-jwq8-jm3v · ZR-a2d0c036
CVSS
9.8 / 10
EPSS
2.2% chance of exploitation within 30 days
Disclosed
14 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 11:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Secure Email Gateway flaw lets outsiders write files and run commands · Zero Radar