This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Cisco Secure Email Gateway fixes an actively exploited vulnerability
Cisco fixes an actively exploited vulnerability in Cisco Secure Email Gateway (AsyncOS) in versions 16.5.0-780 and 15.5.5-014. The fix is also available by updating the Content Scanner Tools package to version 25.3.0.5525 [1].
Allows an unauthenticated remote attacker, in Cisco Secure Email Gateway with the file reputation service of the Advanced Malware Protection functionality assigned to an email policy enabled and a vulnerable version of Content Scanner Tools in use, to write arbitrary files to the appliance's file system by sending malicious email attachments, and thus execute commands with root privileges [1]. IoCs can be found at [1]. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog [2].
The vulnerability is present in product:
- Cisco AsyncOS Software for Cisco Secure Email Gateway; >=16.5, <16.5.0-780; >=16.0, <16.1; >=15.5, <15.5.5-014;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-76519 at cve.org, NVD
- CWE-23: Relative Path Traversal at cwe.mitre.org
The vulnerability was publicly disclosed 14. 10. 2026.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20Arbitrary%20File%20Write%20Vulnerability%26vs_k=1
- [2] https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
By CESNET, z.s.p.o. Martin Krajči on 15. 10. 2026.