Full Report
Both Switchzilla and CISA sound the alarm
Analysis Summary
# Vulnerability: Cisco Secure Email Gateway Remote Code Execution
## CVE Details
- CVE ID: CVE-2026-76519
- CVSS Score: 9.8 (Critical)
- CWE: Improper handling of email attachments (Specific CWE not explicitly cited in text, likely CWE-20 or CWE-434)
## Affected Systems
- Products: Cisco Secure Email Gateway (SEG) - Physical and Virtual appliances.
- Versions: Cisco AsyncOS Software releases earlier than v16.5.
- Configurations: Vulnerable only if **both** of the following conditions are met:
1. The File Reputation service (part of Cisco AMP) is enabled and assigned to a mail policy.
2. The Content Scanner Tools version is earlier than 25.3.0.5525.
## Vulnerability Description
The flaw exists within the Advanced Malware Protection (AMP) feature of the Cisco SEG. Due to the improper handling of email attachments, a remote, unauthenticated attacker can execute a "make-me-root" attack. By sending a specially crafted email with a malicious attachment to the appliance, the attacker can write arbitrary files and execute commands with root-level privileges on the underlying operating system.
## Exploitation
- Status: Exploited in the wild (Zero-day).
- Complexity: Low (Triggered via email delivery).
- Attack Vector: Network.
## Impact
- Confidentiality: High (Full system access).
- Integrity: High (Ability to write files and modify OS).
- Availability: High (Full administrative control).
## Remediation
### Patches
- Cisco recommends migrating to **Cisco AsyncOS Software release 16.5.0-780** or later.
- Ensure Content Scanner Tools are updated to version **25.3.0.5525** or later.
### Workarounds
- There are no official workarounds. Mitigation requires upgrading the software and scanner tools.
## Detection
- Indicators of compromise: Cisco has not publically detailed specific file hashes or C2 infrastructure, but noted that exploitation involves unauthorized file writes and root command execution.
- Detection methods and tools:
- Verify if File Reputation is enabled in mail policies.
- Check Content Scanner Tools version: `Content Scanner Tools version < 25.3.0.5525` indicates vulnerability.
- Federal agencies (US) must follow the CISA KEV catalog deadline of the Saturday following disclosure.
## References
- Cisco Security Advisory: hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
- CISA KEV Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- CVE Record: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-76519