CVE-2026-76519

Undergoing Analysis Undergoing Analysis - In Progress

File Write Vulnerability in Cisco Secure Email Gateway

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Cisco Systems, Inc.

Description

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76519

EUVD

EUVD-2026-101420

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	asyncos	From 15.0 (inc) to 15.5.5-014 (exc)
cisco	asyncos	From 16.0 (inc) to 16.5.0-780 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Cisco Secure Email Gateway's Advanced Malware Protection feature. It allows unauthenticated remote attackers to write arbitrary files on the underlying operating system with root privileges. The issue occurs due to improper handling of email attachments when the File Reputation service is enabled.

Detection Guidance

Check if the File Reputation service is enabled on your Cisco Secure Email Gateway. Verify the Content Scanner Tools version is earlier than 25.3.0.5525. Monitor for unusual file writes or root-level command execution attempts.

Impact Analysis

An attacker could exploit this by sending a crafted email attachment through an affected device. Successful exploitation may allow attackers to write arbitrary files, execute commands with root privileges, remove evidence, or pivot to other systems. This could lead to full system compromise.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized file writes and root-level command execution on affected systems. Attackers could access, modify, or exfiltrate sensitive data, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade to fixed AsyncOS releases (15.5.5-014 or 16.5.0-780) or later.
Update Content Scanner Tools to version 25.3.0.5525 or higher.
Disable the File Reputation service if not required.
Monitor for indicators of compromise and restrict access to the device.

Hi! I’m here to help you understand CVE-2026-76519. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70