Crafted email attachment gives unauthenticated root file write and command execution on Cisco Secure Email Gateway (CVE-2026-76519)
Cisco published the advisory on 2026-10-14 stating its PSIRT is aware of active exploitation and CISA added the flaw to KEV the same day with a 2026-10-17 due date; a gateway left on a vulnerable AsyncOS build can be rooted by anyone able to deliver mail through it.
A relative path traversal in the Advanced Malware Protection (AMP) attachment handling of Cisco Secure Email Gateway lets an unauthenticated remote sender write arbitrary files to the appliance's operating system by sending an email with a crafted attachment, leading to command execution as root. Only appliances with the File Reputation service enabled and assigned to a mail policy are exploitable.
Affected: Cisco AsyncOS for Secure Email Gateway 15.5 releases earlier than 15.5.5-014; Cisco AsyncOS for Secure Email Gateway 16.5 releases earlier than 16.5.0-780
How to Test
Check the AsyncOS release on each Secure Email Gateway: 15.5 builds earlier than 15.5.5-014 and 16.5 builds earlier than 16.5.0-780 are affected. Confirm whether the File Reputation (AMP) service is enabled and assigned to a mail policy, since the flaw is reachable only in that configuration. Because exploitation arrives as a crafted attachment through normal mail flow, review AMP/file-reputation and mail logs for anomalous attachments and processing errors, and inspect the appliance for unexpected files or processes; CERT-EU advises checking all affected appliances for indicators of compromise, and any sign of tampering should be treated as a root-level compromise of the mail perimeter.
How to Patch
Upgrade AsyncOS for Secure Email Gateway to 15.5.5-014 (15.5 train) or 16.5.0-780 (16.5 train). Cisco states there are no workarounds; the vulnerable code path is only reachable when the File Reputation service is enabled and assigned to a mail policy, so appliances that cannot be upgraded immediately should have that exposure reviewed until the fixed build is installed.