cyfenced.com →

[ CVE-2026-76519 · Published 14 Oct 2026 ]

Crafted email attachment gives root on Cisco Secure Email Gateway

Exploited · CISA KEV CVSS 9.8 EPSS 2%4 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-14
  • Critical severity: CVSS 9.8
  • Urgent advisory from CERT-EU, NCSC-NL

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, and an attacker only needs to send an email: no credentials and no user action.

Red alert if
You use Cisco Secure Email Gateway with file reputation or Advanced Malware Protection enabled.
Can wait if
You do not use Cisco Secure Email Gateway, or file reputation is disabled and you patch in your next cycle.
What it is
A path traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway lets an attacker write files and run commands as root by sending an email with a crafted attachment. It applies when the file reputation service is enabled.
Impact
Anyone who can send email to your organisation can take full control of the gateway, with no login and no click by a user. The gateway sees all inbound mail, so an attacker could read or alter email and switch off the filtering that protects users.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends an email with a crafted attachment through the internet-facing gateway.
  2. T1059.004 Command and Scripting Interpreter: Unix ShellThe written files lead to commands running as root on the gateway's operating system.
  3. T1114 Email CollectionWith control of the gateway, the attacker can read the email that passes through it.
  4. T1562 Impair DefensesThey can weaken or switch off malware and spam filtering so later phishing gets through.

What to do

  1. Apply the fixed AsyncOS release from Cisco advisory cisco-sa-esa-afw-zqYJkjxp.
  2. If you cannot upgrade straight away, follow the advisory's workaround guidance for the file reputation and AMP feature.
  3. Check the gateway for unexpected files, configuration changes and administrator accounts, following Cisco's and CISA's guidance.
  4. If you find signs of compromise, rebuild the appliance from a known-good image and rotate its administrator and integration credentials.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

CISA: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References