Loading vulnerability…
Root Command Execution via AMP Path Traversal in Cisco Secure Email Gateway
CVE-2026-76519 is a relative path traversal vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. Improper handling of email attachments when File Reputation is enabled allows an unauthenticated remote attacker to send a specially crafted attachment through an affected gateway, write arbitrary files on its underlying operating system, and potentially execute commands with root privileges. Physical and virtual appliances are exposed when File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is earlier than version 25.3.0.5525. Exploitation requires no recipient interaction or attachment opening. The vulnerability has a CVSS v3.1 score of 9.8, and active exploitation has been confirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can completely compromise appliance confidentiality, integrity, and availability. Root-level access permits manipulation or disclosure of email traffic, theft of credentials and cryptographic material, disruption of mail delivery, modification of security controls, and concealment of local evidence. Exposure of private SSH keys used for cluster authentication can enable compromise of additional cluster members. These are potential consequences of root access; specific post-compromise activities in observed attacks have not been established.
If you can’t patch tonight, do this now.
No workaround addresses the vulnerability. Defense-in-depth measures include restricting access to trusted hosts and necessary ports, separating mail and management interfaces, firewalling management traffic, disabling unnecessary services, and retaining logs externally. Review System Security scan results on every appliance and cluster member, and corroborate them with external network and firewall telemetry for unexpected outbound transfers or anomalous connections. A clean local scan does not exclude compromise because root-level attackers can erase evidence. Escalate suspected compromise or incomplete security scans to Cisco TAC.
Patch, then assume compromise.
Update Content Scanner Tools to version 25.3.0.5525 or later on licensed, supported AsyncOS releases. This update requires neither an AsyncOS upgrade nor an appliance restart. Where automatic updates are disabled, run contentscannerupdate and verify installation with contentscannerstatus. Alternatively, upgrade AsyncOS 15.5 to 15.5.5-014 or later, or AsyncOS 16.5 to 16.5.0-780 or later. AsyncOS 16.0 has no fixed release and must migrate to a fixed branch for an operating-system-level fix; Cisco recommends migrating releases earlier than 16.5 to 16.5.0-780. Cisco-managed Secure Email Cloud Gateway has already received the corrected scanner package. Patching does not remove an existing compromise. Preserve forensic evidence before changes; rebuild compromised virtual appliances using fixed software and fresh configuration rather than importing previous configuration files, and renew credentials and cryptographic material. Contact Cisco TAC for suspected physical-appliance compromise and restore all members of compromised clusters.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
130 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.