2026-017: Critical Vulnerability in Cisco Secure Email Gateway

On 14 October 2026 Cisco disclosed CVE-2026-76519, a critical (CVSS 9.8) relative path traversal flaw in the Advanced Malware Protection File Reputation feature of Cisco Secure Email Gateway that allows unauthenticated remote attackers to write arbitrary files and execute commands as root; Cisco reports active exploitation and warns that compromised appliances in clusters may expose private SSH keys and allow lateral compromise. CERT-EU and Cisco recommend immediately updating the Content Scanner Tools package (>=25.3.0.5525) or upgrading AsyncOS to a fixed release, prioritising internet-reachable appliances, and performing log and network checks for indicators of compromise.