CISCO’S Secure Email Gateway is being exploited in the wild for CVE-2026-76519, a critical arbitrary file write vulnerability rated CVSS 3.1 v3.1 9.8. The flaw lies in the AMP File Reputation feature, specifically in how the file reputation service handles attachments. An unauthenticated remote attacker can send a crafted email to an affected device and write arbitrary files, potentially executing commands with root privileges on the underlying operating system.
Cisco’s PSIRT has stated that exploitation is active, and they have contacted Cisco Secure Email Cloud customers after detecting malicious activity on their appliances. While no public proof-of-concept exploit has been confirmed, the risk is real enough that root access could allow attackers to erase local logs and access private SSH keys shared across clusters, meaning a single compromised node can jeopardise an entire cluster.
Affected products include Cisco Secure Email Gateway appliances (physical and virtual) where the AMP File Reputation service is enabled and assigned to an incoming or outgoing mail policy, and where Content Scanner Tools versions are earlier than 25.3.0.5525 across AsyncOS Software branches 13.0, 13.5, 14.0, 14.2, 14.3, 15.0, 15.5, 16.0, and 16.5.
Cisco advises updating Content Scanner Tools to 25.3.0.5525 or later (contentscannerupdate CLI), and upgrading AsyncOS to fixed releases 15.5.5-014 or 16.5.0-780, noting there are no workarounds. Evidence of compromise should prompt checking system logs for indicators via grep "System Security" system_logs and reviewing external firewall logs; compromised appliances should be rebuilt. Cloud Gateway instances are already patched. The advisory emphasises that exploitation can occur simply by processing a crafted attachment.