# Cisco Secure Email Gateway AMP Relative Path Traversal Zero-Day (CVE-2026-76519) Exploited for Root Command Execution

> Cisco patched CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in the Advanced Malware Protection (AMP) feature of Secure Email Gateway (AsyncOS). It is exploited in the wild: an unauthenticated remote attacker sends an email with a crafted attachment through an appliance with the File Reputation service enabled, writing arbitrary files and executing commands as root.

- **Published:** 2026-10-14T17:37:24Z
- **Last reviewed:** 2026-10-14T18:54:51.835Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3529
- **ID:** TL-2026-3529
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76519, CVE-2026-76461

## Description

CVE-2026-76519 (Cisco advisory cisco-sa-esa-afw-zqYJkjxp, Cisco bug ID CSCwu56223) is a relative path traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway (physical and virtual) running AsyncOS. The root cause is improper handling of email attachments when the File Reputation service is enabled. An unauthenticated remote attacker can send an email containing a crafted attachment through an affected device to write arbitrary files on the underlying operating system and execute commands with root privileges. Cisco scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps it to CWE-23.

The vulnerable condition requires the File Reputation service to be enabled (and assigned to a mail policy, per BleepingComputer) and Content Scanner Tools earlier than 25.3.0.5525. Cisco's fixed releases are AsyncOS 15.5.5-014 (15.5 train) and 16.5.0-780 (16.5 train); administrators on the 16.0 train are told to migrate to a fixed release; Content Scanner Tools 25.3.0.5525 and later contain the fix. NVD lists affected Secure Email versions from 13.0.0 through 16.0.4. Cisco states there are no workarounds.

Cisco confirmed active exploitation in October 2026 and published the advisory on 2026-10-14. No threat actor, malware family, post-exploitation tooling, network IOC or CISA KEV listing was stated in the sources reviewed at the time of writing. Shadowserver tracks roughly 300 exposed Cisco Secure Email Gateway instances. The gateway sits at the mail edge and handles attacker-controlled content, so root compromise of the appliance exposes mail flow and the security control itself.

This is a distinct flaw from CVE-2026-76461 (an SQL injection in AsyncOS email parsing, disclosed and exploited in September 2026 and added to CISA KEV). It is the latest in a series of exploited Cisco SEG/AsyncOS issues cited by BleepingComputer, including CVE-2024-20401 and CVE-2025-20393. Cisco's compromise check is the CLI command grep "System Security" system_logs: the message 'Suspected compromise indicator was found' or 'Security scan did not complete' means contact Cisco TAC; 'No compromise indicator was found' indicates no detected compromise. MITRE mappings below are analyst inference from the described exploit mechanics; the sources do not describe post-exploitation behavior.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1059.004 Unix Shell
- T1685 Disable or Modify Tools

## Sources

- [BleepingComputer: Cisco patches new Secure Email Gateway zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/)
- [Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)
- [NVD: CVE-2026-76519](https://nvd.nist.gov/vuln/detail/CVE-2026-76519)
- [Sophos CTU: Cisco Secure Email Gateway vulnerability CVE-2026-76461 in active exploitation (related prior SEG zero-day)](https://www.sophos.com/zh-cn/blog/cisco-secure-email-gateway-vulnerability-cve-2026-76461-in-active-exploitation)
- [BleepingComputer: New Cisco Secure Email zero-day exploited to execute commands as root (CVE-2026-76461)](https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/)
- [Cybersecurity Dive: Hackers exploit zero-day in Cisco email gateway (CVE-2026-76461)](https://www.cybersecuritydive.com/news/hackers-exploit-zero-day-cisco-email-gateway/830553/)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76461 listed; CVE-2026-76519 not confirmed at time of writing)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3529