Threat reportVulnerabilityTL-2026-3529
Cisco Secure Email Gateway AMP Relative Path Traversal Zero-Day (CVE-2026-76519) Exploited for Root Command Execution
Cisco Secure Email Gateway AMP Relative Path Traversal (TL-2026-3529), also tracked as cisco-sa-esa-afw-zqYJkjxp, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-14. It has no confirmed attribution, affects Cisco Secure Email Gateway (AsyncOS), physical and virtual, references 2 CVEs (CVE-2026-76519, CVE-2026-76461), maps to 4 MITRE ATT&CK techniques (T1059.004, T1190, T1566.001), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3529
- Threat ID
- TL-2026-3529
- Also known as
- cisco-sa-esa-afw-zqYJkjxp, CSCwu56223
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
- Updates
- 2026-10-14 · revalidated 1× · latest source
How Cisco Secure Email Gateway AMP Relative Path Traversal works
Cisco patched CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in the Advanced Malware Protection (AMP) feature of Secure Email Gateway (AsyncOS). It is exploited in the wild: an unauthenticated remote attacker sends an email with a crafted attachment through an appliance with the File Reputation service enabled, writing arbitrary files and executing commands as root.
CVE-2026-76519 (Cisco advisory cisco-sa-esa-afw-zqYJkjxp, Cisco bug ID CSCwu56223) is a relative path traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway (physical and virtual) running AsyncOS. The root cause is improper handling of email attachments when the File Reputation service is enabled. An unauthenticated remote attacker can send an email containing a crafted attachment through an affected device to write arbitrary files on the underlying operating system and execute commands with root privileges. Cisco scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps it to CWE-23.
The vulnerable condition requires the File Reputation service to be enabled (and assigned to a mail policy, per BleepingComputer) and Content Scanner Tools earlier than 25.3.0.5525. Cisco's fixed releases are AsyncOS 15.5.5-014 (15.5 train) and 16.5.0-780 (16.5 train); administrators on the 16.0 train are told to migrate to a fixed release; Content Scanner Tools 25.3.0.5525 and later contain the fix. NVD lists affected Secure Email versions from 13.0.0 through 16.0.4. Cisco states there are no workarounds.
Cisco confirmed active exploitation in October 2026 and published the advisory on 2026-10-14. No threat actor, malware family, post-exploitation tooling, network IOC or CISA KEV listing was stated in the sources reviewed at the time of writing. Shadowserver tracks roughly 300 exposed Cisco Secure Email Gateway instances. The gateway sits at the mail edge and handles attacker-controlled content, so root compromise of the appliance exposes mail flow and the security control itself.
This is a distinct flaw from CVE-2026-76461 (an SQL injection in AsyncOS email parsing, disclosed and exploited in September 2026 and added to CISA KEV). It is the latest in a series of exploited Cisco SEG/AsyncOS issues cited by BleepingComputer, including CVE-2024-20401 and CVE-2025-20393. Cisco's compromise check is the CLI command grep "System Security" system_logs: the message 'Suspected compromise indicator was found' or 'Security scan did not complete' means contact Cisco TAC; 'No compromise indicator was found' indicates no detected compromise. MITRE mappings below are analyst inference from the described exploit mechanics; the sources do not describe post-exploitation behavior.
MITRE ATT&CK techniques used in TL-2026-3529
Execution
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
defense-impairment
Affected products and versions in Cisco Secure Email Gateway AMP Relative Path Traversal
- Cisco — Secure Email Gateway (AsyncOS), physical and virtual
Vulnerable versions: Content Scanner Tools earlier than 25.3.0.5525 with File Reputation service enabled; Secure Email 13.0.0 through 16.0.4 (per NVD)
Fixed in: 15.5.5-014; 16.5.0-780; Content Scanner Tools 25.3.0.5525 and later
Remediation for Cisco Secure Email Gateway AMP Relative Path Traversal
Patches
- AsyncOS 15.5: 15.5.5-014
- AsyncOS 16.0: migrate to a fixed release
- AsyncOS 16.5: 16.5.0-780
- Content Scanner Tools 25.3.0.5525 or later
Immediate actions
- Upgrade Cisco Secure Email Gateway to a fixed AsyncOS release (15.5.5-014 or 16.5.0-780) / Content Scanner Tools 25.3.0.5525 or later
- Run 'grep "System Security" system_logs' on the appliance CLI and review for 'Suspected compromise indicator was found' or 'Security scan did not complete'
- If either message is present, contact Cisco TAC for further recommendations
- Restrict network access to appliance management interfaces
Workarounds
- None available per Cisco advisory cisco-sa-esa-afw-zqYJkjxp
Longer-term hardening
- Restore compromised appliances to a known secure configuration
- Renew credentials and cryptographic materials stored on or reachable from the appliance
- Implement robust access control for appliance administration
- Track Cisco PSIRT advisories for Secure Email Gateway and prioritize CISA KEV entries
CVEs associated with Cisco Secure Email Gateway AMP Relative Path Traversal
Weaknesses (CWE) in Cisco Secure Email Gateway AMP Relative Path Traversal
Timeline of Cisco Secure Email Gateway AMP Relative Path Traversal
- Exploitation of earlier Cisco AsyncOS flaw CVE-2025-20393 begins (month precision), per BleepingComputer context
- Cisco first publishes hardening advisory cisco-sa-hardening-esa-dfCrfXkm covering five Secure Email Gateway and Secure Email and Web Manager vulnerabilities, two known to be exploited
- Cisco discloses SEG zero-day CVE-2026-76461 (email parsing SQL injection) under active exploitation; a distinct flaw from CVE-2026-76519
- CISA KEV remediation deadline for CVE-2026-76461 for US federal civilian agencies
- Cisco updates hardening advisory cisco-sa-hardening-esa-dfCrfXkm alongside the CVE-2026-76519 advisory
- NCSC-NL publishes NCSC-2026-0429 rating probability and impact high, reporting no public PoC and expecting increased scanning and exploitation attempts
- BleepingComputer reports the zero-day; Shadowserver tracks about 300 exposed Cisco Secure Email Gateway instances
- Cisco publishes advisory cisco-sa-esa-afw-zqYJkjxp and fixed releases (15.5.5-014, 16.5.0-780, Content Scanner Tools 25.3.0.5525); NVD entry published; no workaround
- Cisco confirms active exploitation of CVE-2026-76519 in October 2026
Update history for TL-2026-3529
- 2026-10-14 — Cisco Secure Email Gateway Advanced Malware Protection Arbitrary File Write / Root RCE (CVE-2026-76519) Actively Exploited: What changed No field escalation: severity CRITICAL, exploitability ACTIVE, status ACTIVE and CVSS 9.8 are already at their evidenced levels. New indicators (4) 4 behavioral/file/entity indicators: Cisco's compromise-check command, the syst
Sources cited for Cisco Secure Email Gateway AMP Relative Path Traversal
- BleepingComputer: Cisco patches new Secure Email Gateway zero-day exploited in attacks
- Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
- NVD: CVE-2026-76519
- Sophos CTU: Cisco Secure Email Gateway vulnerability CVE-2026-76461 in active exploitation (related prior SEG zero-day)
- BleepingComputer: New Cisco Secure Email zero-day exploited to execute commands as root (CVE-2026-76461)
- Cybersecurity Dive: Hackers exploit zero-day in Cisco email gateway (CVE-2026-76461)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76461 listed; CVE-2026-76519 not confirmed at time of writing)
Detection coverage for TL-2026-3529
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3529 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.