[Urgent] Cisco Secure Email Gateway CVE-2026-76519: Update Content Scanner Tools to 25.3.0.5525 or Later (CVSS v3.1 9.8) — Exploited; a Crafted Attachment Can Give Root

Cisco Secure Email Gateway has a flaw that can let an attacker with no credentials run commands as root on the appliance's operating system, simply by getting an email with a crafted attachment processed by the device. It is CVE-2026-76519. Cisco published its advisory on 14 October 2026 and wrote that "in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CISA added it the same day to KEV (its catalog of known exploited vulnerabilities).

There is no workaround. Update. The Workarounds line of Cisco's advisory says there are no workarounds that address this vulnerability. The fix does not always require a full software upgrade: updating Content Scanner Tools to 25.3.0.5525 or later is enough (no restart needed). However, an appliance that may already be compromised is not restored by updating. Read "If you suspect compromise" below.

This is not the flaw published in September (CVE-2026-76461). The CVE number and weakness type differ (CWE-23 here, SQL injection in September), but both affect Cisco Secure Email Gateway, can lead to root without authentication, and are confirmed exploited. A mail gateway is the front door for inbound email, which is why it keeps being targeted.

Where this score comes from. 9.8 is the CVSS v3.1 rating assigned by Cisco (the CNA); the vector is `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. When checked on 15 October 2026, NVD was still enriching the record and NIST had not assigned its own score. The 9.8 on the NVD page is this Cisco value. The weakness is CWE-23 (relative path traversal) and Cisco's Bug ID is CSCwu56223.

What to do now

• ✓Check whether your appliance is affected. For Cisco Secure Email Gateway (physical and virtual), you are affected if you run a vulnerable release of Cisco AsyncOS and both of these are true (see the fixed releases below for which releases are vulnerable): (1) File Reputation (part of AMP) is enabled and assigned to a mail policy, and (2) the Content Scanner Tools version is earlier than 25.3.0.5525
• ✓Check File Reputation. In the web interface, go to Mail Policies > Incoming Mail Policies (or Outgoing Mail Policies) > Advanced Malware Protection, choose a mail policy and see whether "Enable File Reputation" is checked
• ✓Check the Content Scanner Tools version. Run `contentscannerstatus` at the CLI. Cisco's example shows 25.2.0.5427.15.5.001 as a vulnerable version
• ✓Update. If automatic updates are on and the update has been applied, nothing more is needed. If you disabled them, run `contentscannerupdate` at the CLI. To turn automatic updates on, go to Security Services > Service Updates > Edit Update Settings, check "Automatic Updates", click Submit, then Commit Changes
• ✓Run `contentscannerstatus` again and confirm the version is 25.3.0.5525 or later
• ✓If you use Cisco Secure Email Cloud Gateway, no action is needed on your side. Cisco says it protected the infrastructure and has already deployed the fixed Content Scanner Tools
• ✓Alongside the update, look for signs of compromise. Check the output of `grep "System Security" system_logs` (on every cluster member). Details are under "If you suspect compromise"

What happens (Cisco's description)

• ▸Where: the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. Cisco's name for it is "Cisco Secure Email Gateway Arbitrary File Write Vulnerability"
• ▸Cause: when the File Reputation service is enabled, email attachments are handled improperly
• ▸How it is attacked: an attacker sends an email with a crafted attachment through an affected device, which can let them write arbitrary files on the operating system and run commands with root privileges. No authentication is needed (PR:N, AV:N in the CVSS vector)
• ▸Whether the recipient has to open the attachment is not stated in the advisory. It is described as a flaw in how the device processes the email
• ▸Not affected: Cisco confirmed that Secure Email and Web Manager and Secure Web Appliance are not vulnerable

Fixed releases (from Cisco's advisory)

• ▸AsyncOS 15.5: first fixed release is 15.5.5-014
• ▸AsyncOS 16.0: the table only says "Migrate to a fixed release"; no 16.0 fixed build number is given
• ▸AsyncOS 16.5: first fixed release is 16.5.0-780. Cisco strongly recommends that customers on releases earlier than 16.5 migrate to 16.5.0-780
• ▸Content Scanner Tools: 25.3.0.5525 and later contain the fix, delivered without a software upgrade or restart, according to Cisco
• ▸September's CVE-2026-76461 was also fixed in the same 16.5.0-780. Moving to 16.5.0-780 covers both

If you suspect compromise (Cisco's guidance)

• ▸Check command: `grep "System Security" system_logs`. On a cluster, check every device
• ▸Reading the output: "Suspected compromise indicator was found" means follow the compromise procedure. "Security scan did not complete" means contact Cisco TAC. "No compromise indicator was found" means no sign of compromise, and you should upgrade to a fixed release
• ▸Do not rely on this check alone. An attacker with root can remove or hide evidence, Cisco says. It advises cross-checking network and firewall logs outside the device for unexpected uploads from the appliance to external IP addresses or downloads from malicious IP addresses
• ▸Physical appliances: contact Cisco TAC if exploitation is suspected, and enable remote access on the appliance to speed up the investigation
• ▸Virtual appliances: first record forensic information (upgrading a compromised instance destroys the data and logs). Then deploy a new virtual machine on a fixed release, rebuild the configuration without importing old configuration files, renew credentials and cryptographic material, and keep monitoring
• ▸Clusters: the private SSH keys used between cluster members could be taken from a compromised appliance. If even one member is compromised, Cisco strongly recommends restoring every member of the cluster to a secure configuration
• ▸Secure Email Cloud: Cisco says it investigated and contacted customers directly where indicators of possible compromise were found

Three other entries CISA added the same day (summary only)

On 14 October 2026 CISA added three more vulnerabilities to KEV besides Cisco's. This article covers only Cisco in detail; for the three below I only restate what NVD records and what Ahsay announced. Check each vendor's own page for fixes.

• ▸Palo Alto Networks PAN-OS (CVE-2026-0322): a code injection (CWE-94) in the management interface that lets an authenticated attacker with network access run arbitrary code as root. It applies to PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. The vendor's recommended practice is to restrict management-interface access to trusted internal IPs. CVSS v4.0 is 8.6 (HIGH), assigned by Palo Alto Networks
• ▸Ahsay AhsayCBS (CVE-2026-105133): up to 10.3.2, improper authentication (CWE-287). CVSS v3.1 is 7.3 (HIGH), assigned by VulDB, the CNA
• ▸Ahsay AhsayCBS (CVE-2026-105134): up to 10.3.2, in the Replication Receiver, command injection (NVD classifies it as CWE-77). CVSS v3.1 is 10.0 (CRITICAL), assigned by VulDB, the CNA
• ▸For AhsayCBS fixes, follow Ahsay's newer announcement rather than NVD. NVD's description says upgrading to 10.3.4 mitigates or resolves these, but in an announcement dated 12 October 2026 Ahsay says v9.15.2.59 and v10.3.4.0 did not fully fix these two issues. The current instruction is to apply the v10.3.4.45 hotfix on v10 or the v9.15.2.70 hotfix on v7 to v9, and reboot the server afterwards (both require a partner-portal login). The announcement says nothing about exploitation or severity scores. Do not stop at 10.3.4.0

Timeline

• ▸14 October 2026: Cisco published advisory cisco-sa-esa-afw-zqYJkjxp (Version 1.0, final). The same day, CISA added it to KEV and NVD recorded CVE-2026-76519 (NVD lists a federal due date of 17 October, which binds US federal agencies, not Japanese organizations, but shows how urgent it is considered)
• ▸How it was found: Cisco says it was found during internal security scanning. Separately, it says the PSIRT became aware of exploitation in October 2026. How the two relate has not been published
• ▸September 2026: a different CVE (CVE-2026-76461) was disclosed for the same product and confirmed exploited (see the 15 September article)

What I could not confirm

• ▸The actual attacks. Who is exploiting it, at what scale and against whom is not in Cisco's material
• ▸Whether the recipient must open the attachment. The advisory describes a device-side processing flaw and does not say
• ▸The AsyncOS 16.0 fixed build. The fixed-release table only says to migrate
• ▸NIST's rating. NVD was still enriching the record on 15 October 2026. 9.8 (CRITICAL) is Cisco's value and can change once NIST rates it
• ▸Detailed indicators of compromise. The log check command is given, but no attack file names or IP addresses appear in the official material
• ▸Fixes for Palo Alto Networks. I checked only as far as NVD's description. For Ahsay, only as far as the 12 October 2026 announcement above

Three lines to share

• ▸Cisco Secure Email Gateway has a flaw (CVE-2026-76519, CVSS v3.1 9.8) that can give an unauthenticated attacker root, and Cisco confirms it is exploited. There is no workaround, and CISA added it to KEV on 14 October
• ▸★Run `contentscannerstatus` at the CLI; if Content Scanner Tools is earlier than 25.3.0.5525, update with `contentscannerupdate`. To upgrade the appliance itself, use 15.5.5-014 or 16.5.0-780 or later. Cloud customers need no action
• ▸Updating does not repair an already compromised appliance. Check with `grep "System Security" system_logs` and contact Cisco TAC if you suspect compromise. On virtual appliances, record forensic information before updating