# Cisco Secure Email Gateway CVE-2026-76519: how to patch

> Cisco Secure Email Gateway CVE-2026-76519: fixed versions, how to check and patch, and exploitation status, from Cisco and NVD.

- Published: 2026-10-20
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/cisco-secure-email-gateway-cve-2026-76519-fix/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- Fixed version for 15.5: 15.5.5-014
- Fixed version for 16.0: Migrate to a fixed release.
- CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalogue on 14 October 2026

## Article

Cisco advisory cisco-sa-esa-afw-zqYJkjxp lists fixed versions for CVE-2026-76519, a vulnerability in Secure Email Gateway. Its NVD record lists a CVSS 3.1 base score of 9.8 (critical), scored by Cisco. CISA added it to its Known Exploited Vulnerabilities catalogue on 14 October 2026.

NVD describes it like this:

> A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

## What is affected

In the advisory's words:

> This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, if it is running a vulnerable release of Cisco AsyncOS Software and both of the following conditions are met: The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525.

Versions of Cisco AsyncOS Software for Cisco Secure Email Gateway listed in the advisory:

| Product or release | Affected versions | Fixed version |
|---|---|---|
| 15.5 | not given in this row | 15.5.5-014 |
| 16.0 | not given in this row | Migrate to a fixed release. |
| 16.5 | not given in this row | 16.5.0-780 |

Versions are copied from [Cisco advisory cisco-sa-esa-afw-zqYJkjxp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp).

## Fixed versions

- **15.5**: 15.5.5-014
- **16.0**: Migrate to a fixed release.
- **16.5**: 16.5.0-780

## How to check your version

Cisco's advisory gives these steps:

> To determine whether file reputation is enabled, complete the following steps: Connect to the product web-based management interface. Choose Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection. Choose a Mail Policy and inspect the Enable File Reputation check box. If the box is checked, file reputation is enabled.
>
> To determine which version of Content Scanner Tools is running, use the contentscannerstatus command at the CLI.

## How to patch

Upgrade to the fixed version for your release in the table above.

Cisco's advisory says:

> Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
>
> Cisco strongly recommends that customers who are running Cisco AsyncOS Software releases earlier than Release 16.5 migrate to Release 16.5.0-780.
>
> To manually update the Content Scanner Tools, use the command contentscannerupdate at the CLI, as shown in the following example:
>
> To enable automatic updates, complete the following steps on the web-based management interface: Choose Security Services > Service Updates . Click Edit Update Settings . Click the Automatic Updates check box. Click Submit . Choose Commit Changes on the top right of the page. Click Commit Changes to confirm the uncommitted changes.

Full details are in [Cisco advisory cisco-sa-esa-afw-zqYJkjxp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp).

## If you cannot patch yet

Cisco's advisory says:

> There are no workarounds that address this vulnerability.

## Is it being exploited?

CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalogue on 14 October 2026. The catalogue entry gives a due date of 17 October 2026 and lists known ransomware campaign use as "Unknown".

Cisco's advisory says:

> In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

## Severity

NVD lists a CVSS 3.1 base score of 9.8 (critical) for CVE-2026-76519, scored by Cisco, with the vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.

## Sources

- [NVD: CVE-2026-76519](https://nvd.nist.gov/vuln/detail/CVE-2026-76519)
- [Cisco advisory cisco-sa-esa-afw-zqYJkjxp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)
- [CISA Known Exploited Vulnerabilities catalogue: CVE-2026-76519](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519)

## Sources

- [NVD CVE-2026-76519](https://nvd.nist.gov/vuln/detail/CVE-2026-76519)
- [Cisco advisory cisco-sa-esa-afw-zqYJkjxp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)
- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519)