DaystoPatch

CiscoExploited incident

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

CVE-2026-76519Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 14 Oct 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-esa-afw-zqYJkjxpClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e5910cec94d3e81c…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-76519)ClaimedQuote verified14 Oct 2026

    Cisco Secure Email Gateway Relative Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-10-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-esa-afw-zqYJkjxpCuratedQuote not checked yet14 Oct 2026, 16:00 UTC

    In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

    Exploitation was first disclosed by this advisory; timestamp is its 'First Published: 2026 October 14 16:00 GMT'. BleepingComputer covered it the same day (October 14, 2026 01:29 PM, after the advisory).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-76519ClaimedQuote verified14 Oct 2026, 16:07 UTC

    A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c59893a4cb4d1d8d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 Oct 2026, 16:26 UTC

    Cisco Secure Email Gateway CVE-2026-76519 CVSS 9.8 pre-auth file write to root RCE is being exploited in the wild, no workaround — patch to AsyncOS 15.5.5-014 / 16.5.0-780 now. https://cti.securitycybe

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Oct 2026, 17:39 UTC

    that allowed hackers to write arbitrary files and execute commands with root privileges. This critical flaw, tracked as CVE-2026-76519, was triggered by a simple malicious email attachment, making swift patching a top… https:// osintsights.com/cisco-disrupts -zero-day-attacks-on-secure-email-g

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-esa-afw-zqYJkjxpClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e5910cec94d3e81c…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-esa-afw-zqYJkjxpCuratedQuote not checked yet14 Oct 2026, 16:00 UTC

    First Published: 2026 October 14 16:00 GMT

    First advisory naming CVE-2026-76519. The fix itself shipped a month earlier inside the grouped September hardening release (see patch_first); that advisory did not identify this specific bug, so it is not counted as the vendor acknowledgement.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-hardening-esa-dfCrfXkm (Security Hardening Release: September 2026)CuratedQuote verified

    First Published: 2026 September 14 16:00 GMT

    The hardening release (v1.0, 2026-SEP-14) lists first fixed Secure Email Gateway releases 15.5.5-014 and 16.5.0-780 for its grouped CWE-23 CVE (CVE-2026-76440). The October advisory for CVE-2026-76519 lists the same first fixed releases and links back to this hardening release; v1.1 of the hardening advisory (2026-OCT-14) 'Added link to a related advisory.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ceb975c40e30cf34…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SecurityWeek (Ionut Arghire, October 15, 2026)CuratedQuote verified14 Sep 2026

    Fixes for CVE-2026-76519 were rolled out on September 14, in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780. At the time, Cisco grouped this vulnerability and others under CVE-2026-76440.

    Article dated October 15, 2026, so 'September 14' is 2026-09-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f4c213072edffd91…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Cisco PSIRT advisory cisco-sa-hardening-esa-dfCrfXkm (Security Hardening Release: September 2026)CuratedQuote verified

    First Published: 2026 September 14 16:00 GMT

    Both fixed trains (15.5 and earlier -> 15.5.5-014; 16.5 -> 16.5.0-780) were available at first publication. Release 16.0 gets no in-train fix ('Migrate to a fixed release.'). The October advisory also says the fix is distributed to all supported releases through Content Scanner Tools 25.3.0.5525 or later; we found no release date for that package.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ceb975c40e30cf34…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Secure Email Gateway (AsyncOS)
  • Cisco Secure Email Gateway Content Scanner Tools
  • Cisco Secure Email Cloud
How we built this timeline

Fix predates disclosure: the AsyncOS releases that fix this bug shipped 14 Sep 2026 in the grouped hardening release (cisco-sa-hardening-esa-dfCrfXkm), and exploitation was disclosed 14 Oct 2026 in cisco-sa-esa-afw-zqYJkjxp. Cisco says it became aware of exploitation in October 2026, after the 14 Sep 2026 fix, and no earlier public report was found, so exploited before a fix is false under R4: the first complete fix (14 Sep 2026) was public before the earliest public evidence of exploitation (14 Oct 2026), even though the exploitation start date is unknown.

Whether exploitation actually began before 14 Sep 2026 is not public. BleepingComputer's headline calls it a 'zero-day'.

Affected only when the File Reputation service is enabled and assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Related: cisco-cve-2026-76461 (same hardening release, exploitation disclosed 14 Sep 2026).

Related

Cisco report card