CVE-2026-76519

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

Exploited in the wild. In CISA KEV since 2026‑10‑14. Fixed in 15.5.5-014.

CVSS 3.19.8Critical EPSS percentile75th1.6% chance in 30 days CISA KEVListedsince 2026-10-14, due 2026-10-17
Public exploit: 0 sources Fix15.5.5-014Upgrade to this build

Published 2026-10-14Updated 2026-10-15Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Cisco Secure EmailAffected: 14.0.0-698Upgrade to: not statedAffected: 13.5.1-277Upgrade to: not statedAffected: 13.0.0-392Upgrade to: not statedAffected: 14.2.0-620Upgrade to: not stated + 19 more branchesStated by: CVE record
Cisco AsyncosAffected: ≥ 15.0, < 15.5.5-014Upgrade to: 15.5.5-014Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run a Cisco Secure Email Gateway appliance and whether Advanced Malware Protection (AMP) with file reputation scanning is turned on.
If AMP file reputation is enabled, assume the device may already be compromised and isolate it from the internet immediately.
Apply Cisco's September 2026 software release and the Content Scanner Tools update, which contain the fix — contact Cisco support for the exact build for your version if unsure.
Ask Cisco (via your support channel) whether they have flagged your device as showing signs of compromise, since Cisco has been proactively contacting affected customers.
After updating, have your IT provider check system logs and file integrity for signs of unauthorized file changes or new admin accounts.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

4 publishers

Advisory coverage
as reported · Oct 15, 2026·Help Net Security summary
Exploitation reported in the wild
as reported · Oct 15, 2026·SecurityWeek summary
Added to CISA KEV catalog
Oct 14, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

In plain language

Written by AI from the record

Attackers are actively breaking into Cisco Secure Email Gateway devices right now by emailing a booby-trapped attachment that lets them take full control as the system's top-level administrator — if you run this device with malware scanning enabled, treat this as an emergency.

Unauthenticated remote attackers can achieve root-level arbitrary file write and code execution on Cisco Secure Email Gateway by sending a crafted email attachment that abuses path handling in the Advanced Malware Protection (AMP) file reputation service (CWE-23 path traversal), and this is already under active exploitation per CISA KEV and vendor confirmation.

If you're affected

Full device takeover as root
Email flow disruption or shutdown
Entry point for wider network breach
Data exposure from intercepted mail
Compliance/incident-reporting obligations

What is it

Think of your email security gateway as a mail-room guard that scans incoming packages for malware before letting them through. This flaw lets an attacker disguise a dangerous package so the guard, while trying to inspect it, accidentally lets the attacker rewrite the building's master keys — giving them full control of the building, not just the mail room.

Who is affected

This matters to you if you run a Cisco Secure Email Gateway appliance with the Advanced Malware Protection (AMP) file reputation feature turned on. The attack arrives as an ordinary-looking email, so no employee needs to click anything and no login is required by the attacker.

How urgent is it

Attackers are already exploiting this vulnerability in the wild, and Cisco itself has been contacting customers it found showing signs of compromise. This is listed in the US government's official catalog of actively exploited vulnerabilities with a remediation deadline of October 17, 2026, so this requires action today, not this week.

What to do — in detail

Confirm exposure by checking whether the AMP/file reputation service is enabled on any internet-facing Cisco Secure Email Gateway appliance; this is the reachability gate for exploitation. No official patch advisory numbers were provided in available findings, but vendor/news reporting indicates fixes shipped in Cisco's September 2026 software releases and via an updated Content Scanner Tools package — obtain the exact fixed build from Cisco TAC/support for your current release train. There is no documented interim workaround other than disabling AMP file reputation scanning or taking the device offline from the internet if patching cannot happen immediately; weigh this against loss of malware filtering coverage. CISA's KEV entry sets a remediation due date of 2026-10-17 under BOD 26-04 — treat this as a hard deadline for federal-adjacent and risk-conscious organizations. Post-patch, monitor for unexpected file writes, new or modified system files owned by root, unexplained admin/service accounts, and outbound connections from the appliance; also review Cisco's compromise-notification communications if you've been contacted directly.

Technical context

CVSS 9.8 (CRITICAL), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — unauthenticated, network-exploitable, no user interaction, full compromise of confidentiality/integrity/availability. Weakness is CWE-23 (Relative Path Traversal) in AMP's file reputation handling, enabling arbitrary file write and resulting root-level code execution. Confirmed in CISA KEV (added 2026-10-14, due 2026-10-17) with corroborating news reporting of active exploitation and a public exploit available, placing this at the highest exploitation-maturity tier — EPSS scoring is superseded by confirmed in-the-wild activity and should not be used to downgrade urgency. No formal patch advisory was captured in PATCH findings, though NEWS indicates fixes were released in September 2026 software and Content Scanner Tools updates.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS75th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-10-14.

US federal agencies must remediate by 2026-10-17.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

1.6% chance of exploitation activity in the next 30 days, which ranks it in the 75th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

10 events over 8 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-10-15Patch availablerecord updated, record updated
2026-10-14Added to CISA KEVpublished, weakness classified, att&ck mapped, record updated, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Secure EmailNetworking Infrastructure
- asyncosNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable