Cisco Security Advisories guidance
Vendor revision: Oct 14, 2026Cisco has released software updates that address this vulnerability.
Overview
What is CVE-2026-76519?
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device.
A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Source: NVD
- Reported activity
- Cisco Security Advisories · Published Oct 14, 2026
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
CISA says:Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA catalog due date Oct 17, 2026
Official advisory
Configuration and update guidance
Cisco Security Advisories · Updated Oct 14, 2026
Affected products and configuration
This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, if it is running a vulnerable release of Cisco AsyncOS Software and both of the following conditions are met:
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Determine Whether File Reputation service is Enabled
To determine whether file reputation is enabled, complete the following steps:
Connect to the product web-based management interface.
Choose Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection.
Choose a Mail Policy and inspect the Enable File Reputation check box.
If the box is checked, file reputation is enabled.
Determine the Content Scanner Tools Version
To determine which version of Content Scanner Tools is running, use the contentscannerstatus command at the CLI. The following example shows a vulnerable version of Content Scanner Tools:
cisco-esa> contentscannerstatus Component Version Last Updated Content Scanner Tools 25.2.0.5427.15.5.001 Never updated
Workarounds and temporary mitigations
There are no workarounds that address this vulnerability.
Fixed software
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Fixed Releases
In the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
Cisco AsyncOS Software for Cisco Secure Email Gateway Release | First Fixed Release |
|---|---|
15.5 | 15.5.5-014 |
16.0 | Migrate to a fixed release. |
16.5 | 16.5.0-780 |
Cisco strongly recommends that customers who are running Cisco AsyncOS Software releases earlier than Release 16.5 migrate to Release 16.5.0-780.
The fix for this vulnerability is also distributed to all licensed and supported Cisco AsyncOS Software releases through an updated version of the Content Scanner Tools package. Content Scanner Tools versions 25.3.0.5525 and later contain the fix for this vulnerability.
Update the Content Scanner Tools
Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied. Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.
Manual Update
To manually update the Content Scanner Tools, use the command contentscannerupdate at the CLI, as shown in the following example:
cisco-esa> contentscannerupdate Requesting check for new Content Scanner updates.
For instructions on how to verify the current version, see the Vulnerable Products section of this advisory.
Automatic Update
To enable automatic updates, complete the following steps on the web-based management interface:
Choose Security Services > Service Updates.
Click Edit Update Settings.
Click the Automatic Updates check box.
Click Submit.
Choose Commit Changes on the top right of the page.
Click Commit Changes to confirm the uncommitted changes.
For customers who use Cisco Secure Email Cloud Gateway, no action is required. Cisco has taken actions to protect the infrastructure from this vulnerability, and a fixed version of Content Scanner Tools is already deployed as part of the standard upgrade processes for the environment.
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
Exploitation status
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.