CVE-2026-76519

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway versions prior to AsyncOS 15.5.5-014 Cisco Secure Email Gateway versions prior to AsyncOS 16.5.0-780 Content Scanner Tools versions prior to 25.3.0.5525

Description An unauthenticated remote attacker can write arbitrary files and execute commands with root privileges on the underlying operating system. This issue is caused by a path traversal flaw in the Advanced Malware Protection (AMP) File Reputation scanner due to improper handling of email attachments. An attacker can exploit this by sending an email containing a crafted attachment through an affected device. This flaw has been actively exploited in real-world incidents.

Recommendations Update Content Scanner Tools to version 25.3.0.5525 or newer. Update to AsyncOS version 15.5.5-014. Update to AsyncOS version 16.5.0-780. As a temporary mitigation, disable File Reputation on mail policies.