Cisco Secure Email Gateway flaw allows root command execution

What happened

Tracked as CVE-2026-76519, the newly disclosed Cisco vulnerability sits within the email product's malware scanning component, known as AMP (Advanced Malware Protection). The issue is a relative path traversal weakness (CWE-23) in how the product processes email attachments when the file reputation service is turned on.

An attacker without credentials could trigger the flaw remotely simply by getting a specially crafted attachment to pass through a vulnerable gateway. If successful, the attacker could place arbitrary files on the underlying operating system and run commands there with root privileges.

Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 2026-10-14. The same day, CISA added the flaw to its Known Exploited Vulnerabilities catalog, meaning it is being actively exploited. Ransomware use is not known.

Who is affected

The flaw affects Cisco Secure Email Gateway running Cisco AsyncOS in two version ranges: 15.0 up to but not including 15.5.5-014, and 16.0 up to but not including 16.5.0-780. According to the description, the vulnerable code path is reached when the file reputation service of the AMP feature is enabled. Organizations running these releases on internet-facing mail gateways should treat the issue as urgent.

How serious is it

The flaw carries a CVSS 3.1 base score of 9.8, rated critical. It can be exploited over the network with low complexity, no privileges and no user interaction, and a successful attack gives full control of the device at root level.

Exploitation is confirmed: CISA lists the vulnerability in its Known Exploited Vulnerabilities catalog and set a remediation due date of 2026-10-17 for federal agencies. The EPSS score, an estimate of exploitation likelihood, is 0.06227. Because email gateways process mail from outside the organization by design, exposure is broad.

What you should do

1. 1Review Cisco advisory cisco-sa-esa-afw-zqYJkjxp and apply the fixed AsyncOS release it identifies for your version train.
2. 2Identify all Secure Email Gateway appliances running AsyncOS 15.0 before 15.5.5-014 or 16.0 before 16.5.0-780.
3. 3Check whether the AMP file reputation service is enabled on each affected device.
4. 4Apply Cisco's mitigations if you cannot update immediately, as CISA's required action directs.
5. 5Investigate affected gateways for signs of compromise, given that the flaw is actively exploited.

Quick facts