Cisco Secure Email Gateway AMP Arbitrary File Write and Root RCE Vulnerability (CVE-2026-76519)
Executive & SecOps Summary
SECOPS ASSESSMENTAll versions of Cisco Secure Email Gateway with Advanced Malware Protection (AMP) and File Reputation service enabled.
An unauthenticated remote attacker can overwrite system files and execute arbitrary commands with root privileges by sending a crafted email attachment.
Immediately apply the official AsyncOS security patches provided by Cisco. If patching is not possible, disable the AMP File Reputation feature as a temporary workaround.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Apply Security Updates: Download and install the latest AsyncOS updates from the Cisco Software Central portal.
- Temporary Workaround: Disable the AMP File Reputation service via the CLI or GUI to mitigate the risk until a patch can be applied.
# CLI Workaround
antimalwareconfig -> file reputation -> disable- Monitoring: Inspect system logs for unauthorized file writes or modifications to critical system configuration files.
Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
CVE-2026-76519 is a critical vulnerability rooted in improper input validation of email attachment paths within the AMP engine of Cisco Secure Email Gateway. When the File Reputation service is active, the system fails to properly sanitize file paths (CWE-23), allowing an attacker to perform directory traversal. By sending a specially crafted attachment, an attacker can write arbitrary files to the underlying operating system. Since the vulnerable process operates with elevated privileges, this can lead to full system compromise via Remote Code Execution (RCE) with root access. The vulnerability is currently listed in the CISA KEV catalog, indicating active exploitation in the wild.
Official Vendor Advisories & References
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.