On October 14, 2026, NVD published CVE-2026-76519 and CISA added it to the KEV catalog the same day, due October 17. It affects Cisco Secure Email Gateway, in the Advanced Malware Protection (AMP) feature. Rated 9.8.
What sets it apart: there's no need to reach the admin interface. Sending an email is enough.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD published | 2026-10-14 |
| Added to CISA KEV | 2026-10-14 |
| CISA due date | 2026-10-17 |
| Known ransomware use | no (per CISA) |
What the Flaw Does
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled.
CISA classifies it as relative path traversal. When AMP's file reputation service is enabled, the gateway mishandles certain attachments. An unauthenticated attacker sends an email with a crafted attachment; the gateway processes it, and the attacker can write arbitrary files and run commands as root on the underlying OS.
Why It Matters: No Interface Exposure Required
For most edge devices, the baseline advice is to keep the admin interface off the internet. That doesn't help here.
An email gateway exists to receive email from the internet. SMTP is open by definition, and every inbound message gets scanned — that's the job. The attack surface is the mail flow itself.
The irony is hard to miss: the flaw sits in the anti-malware feature. The option you turn on to defend against malicious attachments is the one that handles one dangerously.
With root on the gateway, an attacker sits in the path of all the organisation's inbound and outbound mail: reading, altering, rerouting, plus a foothold on the internal network.
This is the second time in a month that Secure Email Gateway has landed in KEV (the previous one on September 14): see CVE-2026-76460 and 76461 in Cisco ISE and Secure Email Gateway.
Versions
NVD lists two AsyncOS bounds: 15.5.5-014 and 16.5.0-780. These are CPE configuration bounds, not necessarily the fixed releases to install. Check the Cisco security advisory for the fixed release on your AsyncOS branch.
Exposure applies to gateways where AMP and the file reputation service are enabled. Check your configuration rather than assuming.
Detection
- Unexpected processes or unusual outbound connections from the gateway
- Modified files on the system outside Cisco updates
- Accounts or access keys added with no documented change
- Attachments processed by AMP that coincide with errors or service restarts in gateway logs
- Mail routing or filtering rules changed for no known reason
Mitigation
- Apply the AsyncOS update Cisco lists for your branch, before the October 17 deadline.
- Check whether AMP and file reputation are enabled. If Cisco documents a workaround tied to this feature, weigh it until you can patch — knowing you lose a layer of anti-malware protection.
- Don't count on restricting the admin interface: still good practice, but it doesn't stop this attack.
- If in doubt: treat the gateway as compromised, follow the forensic triage procedure CISA asks for, review mail rules and rotate the credentials and certificates it holds.
Why Monitor Your Email Gateways
An email gateway is exposed by nature; you can't hide it behind a VPN. When an exploited CVE triggers from a single message, time to patch is the only variable that matters.
With cveo.tech, inventory your email gateways with exact AsyncOS versions, and get alerted whenever a CISA KEV CVE affects them.