Cisco Secure Email Gateway AMP File Reputation Path Traversal to Root RCE

CVE-2026-76519 is a relative path traversal (CWE-23) in the Advanced Malware Protection (AMP) File Reputation handler of Cisco Secure Email Gateway (SEG). When AMP's File Reputation service is enabled and the Content Scanner Tools package is older than 25.3.0.5525, a crafted email attachment causes the appliance to write an attacker-controlled file to an arbitrary path on the underlying AsyncOS filesystem — with root privileges. Because the appliance's MTA accepts mail from the internet by design, exploitation requires nothing more than sending an email. No authentication. No user interaction. No click. The result is full root-level command execution on the box that inspects every inbound message your organization receives. Affected AsyncOS branches span 13.0 through 16.5, covering virtually the entire installed base. Cisco published fixed builds on September 14, 2026 (AsyncOS 15.5.5-014 and 16.5.0-780) and a Content Scanner Tools update (25.3.0.5525) that can be applied independently without an AsyncOS upgrade or reboot. Cisco's internal bug ID is CSCwu56223 (advisory cisco-sa-esa-afw-zqYJkjxp).

Cisco rates this CRITICAL / 9.8 and, for once, the vendor score is exactly right — arguably conservative given the operational context. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H correctly reflects the zero-friction remote attack path. There are no workarounds and no mitigations short of patching. CISA added it to KEV on October 14 with a three-day federal remediation deadline of October 17 — the fastest turnaround CISA assigns. This is the second actively exploited Cisco SEG zero-day in 30 days (the first was CVE-2026-76461, a SQL-injection-to-root flaw disclosed September 14), suggesting a sustained campaign against email gateway infrastructure. Cisco confirms active exploitation but has not disclosed threat-actor identity, number of compromised appliances, or post-exploitation objectives. Root access on SEG means the attacker can read, modify, or exfiltrate every email flowing through the gateway, disable AMP scanning to allow subsequent malware delivery, harvest stored credentials and TLS keys, and — critically — scrub the on-box forensic evidence of their own presence.

Sources.

1. Cisco Advisory cisco-sa-esa-afw-zqYJkjxp
2. SecurityWeek — Cisco Warns of Exploited SEG Vulnerability
3. BleepingComputer — Cisco patches SEG zero-day exploited in attacks
4. Zerohunt — Root file write from a single email
5. CISA KEV Catalog — CVE-2026-76519 added 2026-10-14
6. SOC Prime — CVE-2026-76519 Analysis
7. TechBriefly — Cisco SEG zero-day under active attack
8. PK Sharma — Second exploited SEG flaw in 30 days

Run this script on the Cisco SEG appliance itself via SSH or console as an admin user. It checks the installed Content Scanner Tools version against the fixed threshold. Example: ssh [email protected] then paste the script, or save as check_cve_2026_76519.sh and run bash check_cve_2026_76519.sh. Requires CLI access to the appliance (admin role).

#!/bin/bash
# CVE-2026-76519 Vulnerability Check for Cisco Secure Email Gateway
# Checks Content Scanner Tools version and File Reputation status
# Output: VULNERABLE / PATCHED / UNKNOWN
# Run on: Cisco SEG appliance via SSH/console

FIXED_MAJOR=25
FIXED_MINOR=3
FIXED_PATCH=0
FIXED_BUILD=5525

echo "=== CVE-2026-76519 Check ==="
echo "Fixed in: Content Scanner Tools >= 25.3.0.5525"
echo ""

# Attempt to get CST version from contentscannerstatus or updater logs
CST_VERSION=""
if command -v contentscannerstatus &>/dev/null; then
  CST_VERSION=$(contentscannerstatus 2>/dev/null | grep -i 'content scanner tools' | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
elif [ -f /data/scanners/version.txt ]; then
  CST_VERSION=$(grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' /data/scanners/version.txt 2>/dev/null | head -1)
fi

# Fallback: try grep from system logs
if [ -z "$CST_VERSION" ]; then
  CST_VERSION=$(grep -i 'Content Scanner Tools' /data/log/system_logs 2>/dev/null | tail -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [ -z "$CST_VERSION" ]; then
  echo "[!] Could not determine Content Scanner Tools version."
  echo "    Try running 'contentscannerstatus' in the appliance CLI."
  echo "RESULT: UNKNOWN"
  exit 2
fi

echo "Installed CST version: $CST_VERSION"

# Parse version components
IFS='.' read -r V_MAJ V_MIN V_PAT V_BLD <<< "$CST_VERSION"

# Compare versions
VULNERABLE=0
if [ "$V_MAJ" -lt "$FIXED_MAJOR" ]; then
  VULNERABLE=1
elif [ "$V_MAJ" -eq "$FIXED_MAJOR" ]; then
  if [ "$V_MIN" -lt "$FIXED_MINOR" ]; then
    VULNERABLE=1
  elif [ "$V_MIN" -eq "$FIXED_MINOR" ]; then
    if [ "$V_PAT" -lt "$FIXED_PATCH" ]; then
      VULNERABLE=1
    elif [ "$V_PAT" -eq "$FIXED_PATCH" ]; then
      if [ "$V_BLD" -lt "$FIXED_BUILD" ]; then
        VULNERABLE=1
      fi
    fi
  fi
fi

# Check for compromise indicators
echo ""
echo "--- Compromise Indicator Check ---"
if [ -f /data/log/system_logs ]; then
  COMPROMISE=$(grep 'System Security' /data/log/system_logs 2>/dev/null | tail -5)
  if [ -n "$COMPROMISE" ]; then
    echo "$COMPROMISE"
  else
    echo "No 'System Security' entries found in logs."
  fi
else
  echo "Cannot access system_logs (may need elevated privileges)."
fi

echo ""
if [ "$VULNERABLE" -eq 1 ]; then
  echo "*** RESULT: VULNERABLE ***"
  echo "CST $CST_VERSION is below fixed version 25.3.0.5525"
  echo "ACTION: Update Content Scanner Tools immediately or upgrade AsyncOS."
  exit 1
else
  echo "RESULT: PATCHED"
  echo "CST $CST_VERSION meets or exceeds fixed version 25.3.0.5525"
  exit 0
fi