server · disclosed 14 October 2026
Cisco Secure Email Gateway file-write flaw under active attack
A path traversal flaw (CVE-2026-76519, CVSS 9.8) lets an unauthenticated sender write files to a Cisco Secure Email Gateway when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco reports active exploitation.
- Detectable by a website scanNo, server-side only
- Last reviewed24 October 2026
Timeline
- Cisco advisory cisco-sa-esa-afw-zqYJkjxp published; CISA lists the flaw as exploited.
Affected packages
| Package | Affected versions |
|---|---|
Cisco AsyncOS for Secure Email Gateway | Content Scanner Tools before 25.3.0.5525, with File Reputation enabled |
What to do
- Run contentscannerstatus on the appliance and confirm Content Scanner Tools is 25.3.0.5525 or later.
- Upgrade AsyncOS to a fixed release: 15.5.5-014 or 16.5.0-780 or later (16.0 must migrate).
- Restrict the management interface to trusted networks.
Sources
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.