Hunting for CVE-2026-76519 traces on Cisco Secure Email Gateway

CVE-2026-76519 (CVSS 9.8, bug CSCwu56223) lets an unauthenticated sender reach root on Cisco Secure Email Gateway when the AMP file reputation service is enabled. Exploitation is confirmed; builds on branches 13.0–16.5 with Content Scanner Tools older than 25.3.0.5525 are affected. The fix is an update to 25.3.0.5525 or AsyncOS 15.5.5-014 and 16.5.0-780.

• CVSS 9.8: unauthenticated sender gains root via email attachments
• Affected branches: 13.0, 13.5, 14.0, 14.2, 14.3, 15.0, 15.5, 16.0 and 16.5
• Patch applies via contentscannerupdate without a restart
• Cisco advises rebuilding the appliance and rotating keys if compromised