Cisco Secure Email Gateway: Arbitrary file write via AMP File Reputation

Summary

A flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway (AsyncOS) allows an unauthenticated remote attacker to write arbitrary files on the underlying operating system. The attacker only needs to send an email with a crafted attachment through the affected device, and a successful exploit can execute commands with root privileges. The device is affected only if File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco reports active exploitation, and CISA has added the vulnerability to the KEV catalog.

Affected

• Cisco Secure Email Gateway (physical and virtual) running vulnerable AsyncOS releases, including 13.x, 14.x, 15.0.x, 15.5.0 and 15.5.1 builds listed in the CVE record
• Only if File Reputation (part of Cisco AMP) is enabled and assigned to a mail policy
• Only if Content Scanner Tools is earlier than 25.3.0.5525
• Not affected according to Cisco: Secure Email and Web Manager, Secure Web Appliance

Fixed in

• AsyncOS 15.5: 15.5.5-014 or later
• AsyncOS 16.5: 16.5.0-780 or later
• AsyncOS 16.0: migrate to a fixed release (no build named by Cisco; do not treat 16.0.4-302 as safe)
• Content Scanner Tools: 25.3.0.5525 or later

Workaround

• Cisco states that no workarounds are available.
• Disabling File Reputation would remove the precondition, but this is not a Cisco-stated mitigation and its effectiveness is unverified. Use it only as a short-term stopgap.

Exploitation

• Cisco PSIRT became aware of active exploitation in October 2026.
• CISA KEV: added 2026-10-14, due date 2026-10-17 for US federal agencies.
• Ransomware use: unknown. Scale of attacks: unknown.
• No public proof-of-concept confirmed in the sources reviewed.

Our recommendation

• Check whether File Reputation is enabled on any mail policy and run contentscannerstatus to verify the Content Scanner Tools version.
• Upgrade to a fixed AsyncOS release and to Content Scanner Tools 25.3.0.5525 or later.
• If the appliance was exposed while vulnerable, treat it as potentially compromised: record forensics before upgrading, review system_logs for the 'System Security' entries, and check firewall and network logs outside the device for unexpected uploads to external IP addresses.
• If a compromise is indicated, rebuild the appliance on a fixed release without importing old files, renew credentials, and restore every affected cluster member.
• Confirm with Cisco TAC if any indicator is found or if the 16.0 upgrade path is unclear.
• Verify whether Security Management Appliance is affected before acting on it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Mickysalivan/CVE-2026-76519-Proof-of-concept

Research sources

• Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp sec.cloudapps.cisco.com
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-76519 www.cisa.gov
• Cisco advisory (fixed releases table) www.cisco.com
• BetaNews: Cisco email gateway CVE-2026-76519 exploited betanews.com
• GBHackers: Cisco Secure Email Gateway zero-day gbhackers.com
• Threat Frontier: Cisco Secure Email Gateway CVE-2026-76519 exploited (root) threatfrontier.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:23.