CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

The flaw is a relative path traversal (CWE-23). When File Reputation is enabled, the gateway mishandles email attachments it scans. A crafted attachment makes it write files outside the intended directory on the underlying operating system.

The attacker needs only the ability to send mail that passes through the gateway. No login and no user interaction are required. Cisco says a successful exploit lets the attacker write arbitrary files and execute commands with root privileges.

A mail gateway sits at the network edge and sees all inbound mail. A root compromise exposes mail content, and gives a foothold for moving into the internal network. Root access also lets an attacker hide evidence on the device.

Cisco found the flaw in its internal security scanning, and its PSIRT reports active exploitation in October 2026. Secure Email and Web Manager and Secure Web Appliance are not affected.

A physical or virtual Cisco Secure Email Gateway is affected when both conditions hold:

• File Reputation (part of AMP) is enabled and assigned to a mail policy.
• Content Scanner Tools is earlier than 25.3.0.5525.

To check the Content Scanner Tools version, run this on the appliance CLI. Cisco's example of a vulnerable value is 25.2.0.5427.

contentscannerstatus

To check File Reputation, open Mail Policies > Incoming (or Outgoing) Mail Policies > Advanced Malware Protection and look at the Enable File Reputation setting for each policy.

Cisco lists these first fixed releases by AsyncOS train:

• 15.5: 15.5.5-014
• 16.0: migrate to a fixed release (Cisco names no build)
• 16.5: 16.5.0-780

Cisco recommends that customers on releases earlier than 16.5 move to 16.5.0-780. Updating Content Scanner Tools to 25.3.0.5525 or later also fixes the flaw and needs no restart. Cisco lists no workaround.

CISA added the CVE to the KEV catalog on 2026-10-14 with a due date of 2026-10-17, which binds US federal agencies. The required action is to apply mitigations per vendor instructions under BOD 26-04, follow CISA's forensics triage requirements, and stop using the product if mitigations are unavailable.

Cisco gives a log check. Run this on the appliance, and on every member of a cluster:

grep "System Security" system_logs

The result tells you what to do:

• "Suspected compromise indicator was found": contact Cisco TAC and follow the advisory's recommendations.
• "Security scan did not complete": contact TAC.
• "No compromise indicator was found": no compromise detected. Upgrade to a fixed release.

Root access can hide evidence, so a clean result is not proof. Cisco advises checking network and firewall logs for unexpected outbound uploads or downloads involving malicious IP addresses.

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.