CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) Catalog on October 14, 2026, based on evidence of active exploitation. Cisco says it has become aware of exploitation during October; the flaw affects a specific Cisco Secure Email Gateway configuration and could let an unauthenticated attacker run commands as root through a crafted email.
What CVE-2026-76519 could allow
The flaw involves relative path traversal in Advanced Malware Protection (AMP) attachment processing. The Hacker News reports that an attacker could send a specially crafted email through an affected gateway to write arbitrary files and execute commands with root privileges on the appliance. The Register reports a CVSS severity score of 9.8.
The Hacker News reports that fixed AsyncOS builds shipped in a September 14 hardening release, before Cisco became aware of exploitation during October. The vulnerability was later identified as CVE-2026-76519.
Which gateways meet the reported exposure conditions?
The reported exposure applies to physical and virtual Cisco Secure Email Gateway appliances running a vulnerable AsyncOS release when both conditions are met: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525. Administrators can check the relevant settings and version as follows:
| Reported condition | How to check |
| File Reputation is enabled and assigned to a mail policy | Review the relevant incoming or outgoing policy under Mail Policies, then Advanced Malware Protection; check whether Enable File Reputation is selected. |
| Content Scanner Tools is earlier than 25.3.0.5525 | Run contentscannerstatus and check the displayed version. |
The Hacker News identifies Secure Email and Web Manager and Secure Web Appliance as outside the affected scope it describes.
Reported fixes
The Hacker News lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases. It also reports that Content Scanner Tools 25.3.0.5525 or later fixes the issue on licensed and supported AsyncOS releases. The scanner update can install without an AsyncOS upgrade or restart; administrators can run contentscannerupdate if automatic scanner updates are disabled. The Register reports that Cisco says there is no workaround.
If an appliance may be compromised
A reported Cisco compromise check is grep "System Security" system_logs. A result with no indicator does not establish that the appliance is clean: an attacker with root access could hide or remove evidence. The Hacker News also reports Cisco guidance to review firewall and external network logs for unusual transfers, including uploads to unfamiliar addresses.
For a potentially compromised virtual appliance, the reported recovery sequence is to preserve forensic data before making changes, deploy a new virtual machine on a fixed release, rebuild its configuration without importing the previous configuration file, renew credentials and cryptographic material, and continue monitoring. If one member of a cluster is compromised, Cisco recommends restoring every member. For a physical appliance, the reported guidance is to contact Cisco Technical Assistance Center (TAC) and enable remote access for investigation.
Who must follow CISA BOD 26-04?
CISA says Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. The directive prioritizes high-risk vulnerabilities on publicly exposed assets when exploitation could grant total control, and sets expectations for checking systems for compromise before patching. CISA separately encourages other organizations to use risk-based vulnerability management for KEV entries.
