Cisco patches exploited Secure Email Gateway root RCE

CVE-2026-76519, a path-traversal flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway (SEG), is being exploited in the wild. Cisco disclosed it on October 14 in advisory cisco-sa-esa-afw-zqYJkjxp and scored it CVSS 9.8. An unauthenticated attacker triggers it by sending an email with a crafted attachment through the gateway; a successful exploit writes arbitrary files to the appliance OS and can run commands as root. No login, no interaction beyond the mail flow the device exists to process.

What's affected

Per the Cisco advisory, both conditions must hold:

• The File Reputation service is enabled and assigned to a mail policy.
• The Content Scanner Tools version is earlier than 25.3.0.5525.

Both physical and virtual SEG appliances on vulnerable AsyncOS releases are in scope. Secure Email and Web Manager and the Secure Web Appliance are not affected. Check the installed scanner version with the contentscannerstatus CLI command.

Exploitation status

Cisco's PSIRT says it became aware of active exploitation in October 2026. The company has not published attacker attribution, a victim count, or confirmation that root was obtained in observed attacks. Cisco deployed mitigations to its managed Secure Email Cloud instances and says it contacted customers whose devices showed indicators of possible compromise. Cisco's updated hardening advisory now flags two actively exploited flaws on the platform; this file-write bug is one, alongside last month's SEG zero-day CVE-2026-76461.

Cisco shipped an IOC table inside the advisory and describes three triage outcomes from the appliance logs: compromise detected, scan incomplete (contact TAC), or no compromise found. Pull the indicators from the advisory directly — do not rely on a paraphrase.

Action checklist

1. Update Content Scanner Tools to 25.3.0.5525 or later. Cisco states this installs without a software upgrade or appliance restart, so there is no change-window excuse to wait.
2. Patch AsyncOS to a fixed build. 15.5 → 15.5.5-014; 16.5 → 16.5.0-780. AsyncOS 16.0 has no fixed build — migrate to a fixed release.
3. Check your exposure fast: run contentscannerstatus and confirm whether File Reputation is enabled and bound to a mail policy. If it is and the scanner is below 25.3.0.5525, treat the appliance as reachable.
4. Hunt for compromise. Work the IOC table in cisco-sa-esa-afw-zqYJkjxp and the appliance's own scan-status log messages. Review firewall and network logs for suspicious outbound traffic from the gateway.
5. If you run Secure Email Cloud, check whether Cisco contacted you about possible compromise and follow its guidance — the appliance filters inbound mail for the whole org, so a root foothold there sees everything.

Context

This is the second actively exploited Secure Email Gateway flaw Cisco has confirmed in as many months, after CVE-2026-76461. The pattern is familiar for mail-security appliances: they sit at the network edge, parse untrusted attachments by design, and run privileged scanning engines — a combination that turns a parser bug into pre-auth root. A CVSS 9.8 that fires from an ordinary inbound email, with no victim interaction required, belongs at the top of today's queue for anyone running SEG with File Reputation enabled. The patch that matters most is the scanner-tools update, because it lands without downtime and closes the exploited condition directly.