CVE-2026-76519 in Cisco Secure Email Gateway

On 14 October Cisco disclosed CVE-2026-76519: on a Secure Email Gateway with File Reputation enabled, an email with a crafted attachment writes files and runs commands with root privileges, no login needed. Cisco says the flaw is already being exploited. The same day CISA also added CVE-2026-0322 in PAN-OS, which needs a logged-in attacker with high privileges.

In short

14 October 2026: Cisco published an advisory for CVE-2026-76519 (CVSS 9.8, Critical) in Cisco Secure Email Gateway. An unauthenticated remote attacker sends an email with a crafted attachment and can write files and run commands with root privileges.
Two conditions apply: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525. There is no workaround. Fix: 15.5.5-014, 16.5.0-780, or Content Scanner Tools 25.3.0.5525 and later, no restart.
The same day CISA added CVE-2026-0322 in PAN-OS: code execution in the management interface with root privileges, but by a logged-in attacker. Palo Alto Networks reports very limited exploitation. CISA's deadline for both is 17 October.

Checked on17 October 2026Responsible editorCvetelin IvanovHow we workMethod · Corrections

Start with one checkbox. In the gateway's management interface, under Advanced Malware Protection, there is “Enable File Reputation”. If it is ticked, go to the second check: the version of Content Scanner Tools. If that is also below 25.3.0.5525, the gateway is affected.

This is the same gateway Cisco patched a month ago. One email again, root again, no login again and no workaround. The door is different: this time it is the attachment the gateway scans for malware.

The facts: on 14 October 2026 Cisco published an advisory for CVE-2026-76519 in Cisco Secure Email Gateway, physical and virtual. Cisco rates it Critical, 9.8 on CVSS, weakness CWE-23. The flaw is in the Advanced Malware Protection (AMP) feature and comes from improper handling of email attachments when the file reputation service is enabled. An unauthenticated remote attacker sends an email with a crafted attachment through an affected device and can write arbitrary files and execute commands with root privileges on the underlying operating system. A device is affected when both conditions are true: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525. There are no workarounds. The fixed releases are 15.5.5-014 and 16.5.0-780; for 16.0 Cisco says to migrate to a fixed release. The fix also ships in Content Scanner Tools 25.3.0.5525 or later, which does not require a software upgrade or a restart. According to Cisco, its security response team became aware of active exploitation in October 2026; the flaw was found during internal security scanning. Secure Email and Web Manager and Secure Web Appliance are not affected. On 14 October CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog with a deadline of 17 October. The same day CISA also added CVE-2026-0322: a code execution vulnerability in the PAN-OS management interface from Palo Alto Networks that needs an authenticated attacker with network access and gives root privileges on the firewall. Palo Alto Networks says very limited exploitation has been observed and no known workarounds exist; Cloud NGFW and Prisma Access are not affected. CISA's deadline for both is 17 October and applies to US federal civilian agencies. For both, the catalog, under directive BOD 26-04, also requires a forensic triage to check whether the system is already compromised.

There is good news too. The fix doesn't wait for a full software upgrade: it also ships as a Content Scanner Tools package, no restart. If automatic updates are on, once the package arrives you have nothing to do. If you switched them off, the command is contentscannerupdate.

The log is a separate job. You search system_logs for the lines “System Security”, on every gateway if they are in a cluster. If there is a trace, don't rush the upgrade: for virtual appliances Cisco says to record forensic data first, because upgrading a compromised instance destroys it.

The patch can arrive on its own. The log check can't.

The rest is as it was a month ago. If the attacker reached root, they may have wiped their traces, so Cisco advises cross-checking the firewall and network logs around the device. And in a cluster the SSH keys between the gateways may already be in the attacker's hands, and Cisco advises restoring every member of a cluster with at least one compromised device.

PAN-OS is the narrower case. It takes an attacker who is logged in with high privileges, and access to the management interface. The risk is highest when the interface is visible from the internet; Palo Alto Networks advises limiting access to trusted internal addresses. The fixed versions are in the advisory's table, for example 12.2.4, 11.2.16 or 10.2.18-h12.

The flaw a month ago didn't care about settings. This one does, and the answer sits in one checkbox and one version number.

The backstory A month ago the same gateway had another flaw, also root from one email and also with no workaround. That one was SQL injection in how the email was parsed, regardless of settings; this one is a file write through an attachment and needs File Reputation switched on.

The visual is generated code art. No third-party images.

Cisco's email gateway gives root with one message again, this time through an attachment, and PAN-OS entered the exploited-vulnerabilities catalog the same day

More on this

Two JFrog Artifactory flaws entered the catalog of exploited vulnerabilities, along with GitLab and ScreenConnect

Seven flaws in one day in the actively exploited catalogue, LiteLLM and Artifactory among them

Two PaperCut flaws entered the actively exploited catalogue, and they chain together