11 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-76519 is a critical arbitrary file write vulnerability affecting the Advanced Malware Protection (AMP) feature in Cisco Secure Email Gateway. The flaw results from improper handling of email attachments when the File Reputation service is enabled.
An unauthenticated remote attacker can exploit the vulnerability by sending an email containing a crafted attachment through an affected appliance. Successful exploitation may allow arbitrary file writes and command execution with root privileges on the underlying operating system. No credentials or user interaction are required.
Active exploitation has been confirmed. Cisco has released Content Scanner Tools version 25.3.0.5525 to address the vulnerability without requiring a software upgrade or restart. Cisco also recommends upgrading to a fixed AsyncOS release, preferably 16.5.0-780. Organizations should verify their scanner version, review affected mail policies, and investigate appliances for potential comprom
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Arbitrary File Write Vulnerability in Cisco Secure Email Gateway Advanced Malware Protection
Identifier
CVE-2026-76519
PoC or Exploitation
Confirmed actively exploited.
CVSS Score
9.8 (Critical, CVSS v3.1)
Cisco has released fixed software and a fixed Content Scanner Tools package. No workarounds are available.
Affected versions include:Cisco Secure Email Gateway, both physical and virtual, running a vulnerable release of Cisco AsyncOS Software, when both of the following conditions are met.
The File Reputation service, which is part of Cisco Advanced Malware Protection, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco has confirmed that Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected.
Fixed versions include:
-
AsyncOS release 15.5: 15.5.5-014
-
AsyncOS release 16.0: migrate to a fixed release
-
AsyncOS release 16.5: 16.5.0-780 Content Scanner Tools version 25.3.0.5525 and later Cisco strongly recommends that customers running
-
AsyncOS releases earlier than 16.5 migrate to release 16.5.0-780.
The Content Scanner Tools update is distributed to all licensed and supported AsyncOS releases. It does not require a software upgrade or a product restart.
Customers with automatic Content Scanner Tools updates enabled need no action once the update has been applied.
Customers who have disabled automatic updates must apply it manually with the contentscannerupdate command. No action needed for Cisco Secure Email Cloud customers.
Cisco Security Advisory:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Description:
CVE-2026-76519 is an arbitrary file write vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway. It is a relative path traversal flaw.
The vulnerability is due to improper handling of email attachments when the File Reputation service is enabled. An unauthenticated remote attacker can send an email with a crafted attachment through an affected device.
A successful exploit can write arbitrary files and execute commands with root privileges on the underlying operating system. No credentials or user interaction are required.
A successful exploit can write arbitrary files and execute commands with root privileges on the underlying operating system. No credentials or user interaction are required.
Mitigation Recommendation:
Apply the Content Scanner Tools update to version 25.3.0.5525 or later on every Cisco Secure Email Gateway. This update delivers the fix without a software upgrade or a restart. Where automatic updates are disabled, run the contentscannerupdate command to apply it manually.
Schedule an upgrade to a fixed AsyncOS release, with 16.5.0-780 as Cisco’s preferred target. Releases earlier than 16.5 should migrate to this version.
Assess the exposure of each appliance. Run the contentscannerstatus command to confirm the Content Scanner Tools version. Then verify whether the Enable File Reputation setting is active in any incoming or outgoing mail policy under Advanced Malware Protection.
Review each appliance, and each cluster member, for indicators of compromise. Run grep “System Security” system_logs and compare the results against Cisco’s guidance. A suspected compromise message indicates compromise. An incomplete scan message requires contacting the Cisco Technical Assistance Center.
Corroborate the results with logs held outside the appliance. An attacker with root access can alter or remove local evidence. Review network and firewall logs for unexpected outbound uploads or inbound downloads from malicious addresses.
Preserve forensic data before acting on a compromised virtual appliance. Deploy a new virtual machine on a fixed release, rebuild the configuration without importing prior configuration files, and renew all credentials and cryptographic material.
Engage the Cisco Technical Assistance Center for a compromised physical appliance, and enable remote access to support the investigation. Restore every member of a cluster to a secure configuration if any member is compromised. Exploitation may expose the SSH keys used between members.
