BREAKING: Exploited Cisco Secure Email Gateway AMP bug lets attackers write files as root, now on CISA KEV (CVE-2026-76519)

Someone who can email your Cisco Secure Email Gateway a crafted attachment can write files on the box as root, then run commands. Cisco published CVE-2026-76519 on 2026-10-14. The bug sits in Advanced Malware Protection when File Reputation is on a mail policy and Content Scanner Tools is older than 25.3.0.5525. CVSS 9.8, no login required to the gateway as an email peer. Cisco PSIRT says active exploitation started in October 2026. CISA put it on the Known Exploited Vulnerabilities catalog the same day with a federal due date of 2026-10-17. If you run on-prem ESA with AMP File Reputation enabled, this is tonight's work.

This post is our operator read of Cisco's advisory cisco-sa-esa-afw-zqYJkjxp and the CISA KEV entry. The HOL Guard evidence pack for CVE-2026-76519 is the source record.

How to fix

Two paths. Prefer the Content Scanner Tools update if you need a fix without an AsyncOS upgrade or a restart. Prefer the AsyncOS upgrade if you are already planning a train move.

Fast path (no restart): update Content Scanner Tools to 25.3.0.5525 or later. From the CLI:

cisco-esa> contentscannerupdate
Requesting check for new Content Scanner updates.

cisco-esa> contentscannerstatus
Component            Version          Last Updated
Content Scanner Tools 25.3.0.5525     <timestamp>

Confirm the version line is 25.3.0.5525 or newer. If automatic Service Updates are already on (Security Services > Service Updates > Automatic Updates), Cisco says you do not need a manual step once that package has landed. If automatic updates are off, run contentscannerupdate yourself.

AsyncOS upgrade path:

There are no workarounds. Turning AMP off is not listed as a fix; Cisco's remediations are the CST package and/or the fixed AsyncOS builds above.

Cisco Secure Email Cloud: no customer AsyncOS action. Cisco says they already deployed fixed Content Scanner Tools on the cloud fleet. If Cisco contacted you about compromise indicators on a cloud device, renew credentials and crypto material on that appliance as they ask.

Confirm you are actually in scope

Both conditions must be true for the appliance to be vulnerable:

• File Reputation (AMP) is enabled and assigned to an incoming or outgoing mail policy.
• Content Scanner Tools is earlier than 25.3.0.5525.

GUI check for File Reputation:

1. Open the web management UI.
2. Mail Policies > Incoming Mail Policies > Advanced Malware Protection (or the Outgoing path).
3. Open a mail policy and look at Enable File Reputation. Checked means File Reputation is on for that policy.

CLI check for Content Scanner Tools:

cisco-esa> contentscannerstatus
Component            Version             Last Updated
Content Scanner Tools 25.2.0.5427.15.5.001 Never updated

That example from Cisco's advisory is a vulnerable CST build. Anything below 25.3.0.5525 with File Reputation on a mail policy is the case to fix.

Who is not in scope

• Cisco Secure Email Cloud customers for the patch itself. Cisco already acted on CST there. You still follow any compromise notice they send you.
• On-prem appliances where File Reputation is disabled, or enabled but not assigned to any mail policy.
• Appliances already on Content Scanner Tools 25.3.0.5525 or later.
• Secure Email and Web Manager, and Secure Web Appliance. Cisco lists those as not vulnerable. Only products in the Vulnerable Products section of the advisory are affected.

One operator check

On every on-prem ESA (and every cluster member):

cisco-esa> contentscannerstatus
cisco-esa> grep "System Security" system_logs

Then walk Incoming and Outgoing mail policies for Enable File Reputation. After you patch, re-run contentscannerstatus and require CST ≥ 25.3.0.5525.

IOC lines Cisco documents:

• System Security: Suspected compromise indicator was found. Contact TAC for further recommendations. Treat as compromise. Follow the Recommendations section of the advisory (physical: TAC + remote access; virtual: forensics first, then rebuild on a fixed image without importing old config, renew credentials and crypto).
• System Security: Security scan did not complete. Contact TAC for further recommendations. Call TAC.
• System Security: No compromise indicator was found. Still upgrade if you are on a vulnerable release.

Root on a compromised member can steal cluster SSH keys. If one member is compromised, Cisco says restore every member of that cluster to a clean configuration, not just the one that tripped the indicator. Cross-check firewall and network logs outside the ESA for unexpected uploads from the appliance to external addresses; attackers with root can scrub local evidence.

What this is not

This is not a web-management unauthenticated RCE that hits the admin UI from the internet by itself. The attack path is a crafted email attachment processed when File Reputation / AMP is enabled on a mail policy. The attacker still needs to get that mail through the gateway as an email peer. It is still unauthenticated from the mail path, actively exploited, and on KEV with a 2026-10-17 due date.

The details

• CVE: CVE-2026-76519, relative path traversal / improper handling of email attachments in AMP File Reputation (CWE-23, bug CSCwu56223).
• Advisory: cisco-sa-esa-afw-zqYJkjxp, First Published 2026 October 14 16:00 GMT.
• Severity: Critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
• Impact: arbitrary file write and command execution as root on the underlying OS of physical or virtual Secure Email Gateway.
• Affected: Cisco Secure Email Gateway (physical and virtual) on vulnerable AsyncOS when File Reputation is enabled on a mail policy and Content Scanner Tools < 25.3.0.5525.
• Fixed: AsyncOS 15.5.5-014, 16.5.0-780 (16.0 customers migrate); Content Scanner Tools ≥ 25.3.0.5525.
• Exploitation: Cisco PSIRT became aware of active exploitation in October 2026. CISA KEV since 2026-10-14, federal due date 2026-10-17. CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total.
• Workarounds: none.
• Source: found during internal Cisco security scanning.

References

• Cisco Security Advisory: Secure Email Gateway Arbitrary File Write (cisco-sa-esa-afw-zqYJkjxp)
• CISA Known Exploited Vulnerabilities catalog
• NVD: CVE-2026-76519