Cisco split 76519 out of the September group. The attachment is still root.

CVE-2026-76519 is KEV as of 14 October, due 17 October, forensic triage required. Unauthenticated AMP file write via a crafted attachment. Content Scanner Tools 25.3.0.5525 is the close. Not 76461.

RWP Ventures · 2026-10-15 · event 2026-10-14 · 13 min read · priority 8.9

CISA put the CVE on KEV the same day. Catalog freeze this morning is 2026.10.14 / 1745. Due 17 October. forensicTriage: Yes. knownRansomwareCampaignUse: Unknown.

Do not collapse four facts.

1. This is not [CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/). 76461 was SQL injection in email parsing, any configuration, KEV 14 September, due 17 September. 76519 is path traversal in AMP File Reputation. Different CWE. Different bug ID. Different log check. Same mail path, same root outcome. Cisco has not linked the two campaigns.
2. The September hardening already had the code. Cisco shipped the fix on 14 September inside the path-traversal umbrella CVE-2026-76440, in AsyncOS 15.5.5-014 and 16.5.0-780. Under Cisco’s June disclosure policy, a grouped bug gets its own CVE when it is known to be exploited. Wednesday is that split, not a new patch train. Shops that took the September hardening and left Content Scanner Tools on auto-update may already be closed. Shops that only applied 16.0.4-302 for 76461 are not.
3. Two conditions, both required. File Reputation (AMP) enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525. Either missing and 76519 does not fire. That is a configuration fact, not a reason to skip the hunt. The mail path is still the exploit path: closing the admin portal does not close it.
4. A green system_logs grep is not a clean bill. Cisco’s own compromise check can be wiped by the root it is looking for. Off-box logs first. Virtual appliances: rebuild, do not import last week’s config. Clusters: one compromised member’s SSH keys are a path into the rest.

The operator sentence: contentscannerstatus tonight, then forensic triage, then decide whether the box is a patch or a rebuild. Cloud tenants Cisco already called still have to rotate credentials. FCEB clock is Saturday.

What happened

Cisco’s 14 October advisory is the exploitation notice for a bug that was already in the September hardening release. An unauthenticated sender puts a crafted attachment on a message the gateway is designed to ingest. If File Reputation is on and the Content Scanner Tools package is old, AMP mishandles the attachment. The result is an arbitrary file write, then root on AsyncOS.

Cisco: no workarounds. Physical and virtual Secure Email Gateway. Secure Email and Web Manager and Secure Web Appliance are not affected by 76519. Do not patch the wrong product against this CVE and declare the mail path closed.

CISA’s 14 October KEV add is four rows, not one. The others are CVE-2026-0322 (PAN-OS authenticated management-interface RCE), CVE-2026-105133 and CVE-2026-105134 (AhsayCBS, already [Daily Top 11 October](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/)). Those are parallel federal clocks, all due 17 October. They are not this gateway. Catalog moved from yesterday’s freeze 2026.10.13 / 1741 to 2026.10.14 / 1745.

Canadian Centre for Cyber Security issued AV26-1042 Update 1 the same day, repeating Cisco’s exploitation statement and the KEV add. Treat CCCS’s SEWM version list as the September hardening scope, not as a claim that 76519 hits SEWM. Cisco’s 76519 advisory is the product-scope source.

The Hacker News (14 October) and SecurityWeek (15 October) independently relay that Cisco updated the September hardening advisory to say two of the grouped bugs are now known exploited: this file-write (path-traversal class) and September’s SQL injection (improper-neutralization class). Cisco is not aware of attacks on the other bugs in that release. Treat that as CONFIRMED vendor, not as a census.

Why it matters

Secure Email Gateway sits on the MX. The exploit does not need the admin portal, a VPN, or a user click. It needs a message the appliance already accepts. That is the same operational sentence as 76461. The September parser fix does not close the AMP attachment path.

The second reason is the split CVE. Operators who ticketed “we are on 16.5.0-780 / 15.5.5-014 as of mid-September” still have to prove Content Scanner Tools ≥ 25.3.0.5525. Operators who ticketed only 16.0.4-302 for 76461 have a build that Cisco lists as affected for 76519 (16.0.4-016 and later 16.0 in the CVE record; 16.0 has no fixed AsyncOS — migrate). Scanner update does not require a software upgrade or a restart. Assuming the September ISO closed this row is the miss.

The third reason is cluster keys. Cisco: appliances in a cluster authenticate to each other with SSH key pairs. Root on one member can take the private keys. Restore every member of a cluster that contains at least one compromised appliance. That is not optional wording.

This is not confirmed OT process impact. A Secure Email Gateway in front of a plant, a water utility, or a hospital is still an IT compromise of the mail perimeter at an industrial or clinical organization. Do not write a process event. Do not merge it with [yesterday’s Connect Secure chain](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/).

Who / what is affected

Technical context

RWP is not reproducing the exploit. Defenders need the class.

CVE-2026-76519 is relative path traversal in AMP’s handling of email attachments when File Reputation is enabled. Vendor/NVD: unauthenticated remote attacker writes arbitrary files and executes commands with root. CVSS 9.8 CRITICAL. NVD published 14 October; last modified 15 October. CISA SSVC on the OpenCVE/NVD-adjacent record: automatable yes, technical impact total.

Check exposure without treating the CLI as an exploit:

• Web UI: Mail Policies → Incoming (or Outgoing) Mail Policies → Advanced Malware Protection → Enable File Reputation.
• CLI: contentscannerstatus. Example of a vulnerable line from Cisco’s advisory: Content Scanner Tools 25.2.0.5427.15.5.001. Close is 25.3.0.5525 or later.
• Update path: contentscannerupdate, or turn automatic updates on under Security Services → Service Updates. No restart.

Cisco’s on-box compromise check: grep "System Security" system_logs on every cluster member.

Cisco’s own note: successful exploitation yields root, and root can remove or hide the same indicators. Cross-check network and firewall logs off the box for unexpected uploads from the appliance or downloads from untrusted IPs. The advisory does not publish what the scan looks for. Do not treat a clean grep as closure.

ATT&CK mapping for the ticket — public reporting, not a playbook:

Threat / exploitation status

Confidence on the KEV add, the CVE identity, the two-condition exposure, the September fix trains, and Cisco’s exploitation statement: high. Confidence that every File-Reputation SEG on the internet was hit: low — no census. Confidence on first-exploit date inside “October”: low. Confidence that a green system_logs grep after CST update means the box was clean in early October: low.

What defenders should do

1. Inventory every Secure Email Gateway — physical, virtual, clustered, and Cisco Secure Email Cloud. Record AsyncOS train and build. Record contentscannerstatus. Record whether File Reputation is assigned to any incoming or outgoing mail policy. SEWM is a different advisory. Snapshot the strings before you change anything.
2. Close 76519 on an emergency window. Fastest path: CST 25.3.0.5525+ (contentscannerupdate or enable automatic updates, then verify the version). Durable path: AsyncOS 15.5.5-014 or 16.5.0-780. 16.0 has no fixed build — migrate. Pull against cisco-sa-esa-afw-zqYJkjxp, not a slide that says “we patched Cisco email in September.”
3. Forensic triage is the KEV required action, not a suggestion. CISA due 17 October for FCEB. Off-box logs first. Run the System Security grep on every cluster member, then discount it. Unexpected outbound from the appliance is the better signal.
4. If compromise is plausible, do not patch in place and hope. Physical: contact TAC; Cisco asks that remote access be enabled so they can investigate. Virtual: preserve forensics before upgrade (upgrade destroys logs), deploy a new VM on a fixed release, rebuild config without importing previous files, renew credentials and cryptographic material. Cluster: restore every member.
5. Cloud tenants Cisco already called still rotate. CST is already on the cloud fleet. That is not a clean bill for a tenant that received the IoC call. Renew appliance credentials and crypto. Restrict management access.
6. Keep the other clocks. CVE-2026-104935 (Ivanti Connect Secure) is due tomorrow, 16 October, forensic triage Yes — [yesterday’s Daily Top](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/). CVE-2026-96951 (Windows MotW) shares that 16 October due. CVE-2026-0322 (PAN-OS authenticated mgmt RCE) and the Ahsay pair share this Saturday due. Do not steal SEG owners for a firewall ticket.

RWP assessment

Score 8.9.

Highest-leverage development since yesterday’s Ivanti/UTA0576 write-up is a same-day KEV on an unauthenticated Secure Email Gateway root that Cisco had already shipped in the September hardening group, now split to its own CVE because it is being used. Evidence quality is high on Cisco PSIRT, the KEV JSON, NVD/CVE.org, and CCCS. Evidence quality is intentionally split on victim count (unpublished), on first-exploit date inside October, and on whether 76461 and 76519 share an operator.

It outranks CVE-2026-0322 because that KEV is authenticated code injection on the PAN-OS management interface (vendor CVSS 4.0 8.6, PR:H, “very limited exploitation,” Cloud NGFW / Prisma Access not impacted). Important, same due date, not an unauthenticated mail path. It outranks the Ahsay 105133/105134 KEV add because those CVEs were already [Daily Top 11 October](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/) with Huntress SYSTEM RCE and the 10.3.4.45 walk-back; today’s catalog rows are a material increment, not a new product. It outranks a second day on Ivanti because 104935 has no overnight vendor/KEV increment in this retrieval (due still 16 October). It outranks Siemens/Rockwell/Schneider ICS Patch Tuesday because those advisories do not claim exploitation and are not on KEV.

What we are not saying: that every SEG with File Reputation on is confirmed compromised; that 76519 and 76461 are one campaign; that CST auto-update is a substitute for forensic triage; that SEWM is in this CVE; that ransomware is Known on this row; that this is OT process impact.

What we are watching

• Whether Cisco names an actor, a first-exploit date inside October, or a victim census.
• Whether 76519 knownRansomwareCampaignUse flips from Unknown.
• Extra-Cisco victim telemetry (Talos, Mandiant, Unit 42) as separate evidence.
• Whether any remaining September-hardening grouped CVEs get their own exploited-CVE split.
• PAN-OS CVE-2026-0322 IOCs (66.42.72.14, 208.83.239.114, 149.248.47.234) and the 11.2.16 ETA today.
• Catalog freeze is now 2026.10.14 / 1745. Yesterday’s freeze was 2026.10.13 / 1741.

Sources

• Cisco — Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp, 14 October 2026)
• Cisco — SEG and SEWM Security Hardening Release, September 2026
• CISA — four KEV additions, 14 October 2026
• CISA KEV JSON catalog 2026.10.14
• CISA — Known Exploited Vulnerabilities Catalog
• CISA KEV — CVE-2026-76519
• NVD — CVE-2026-76519
• CVE.org — CVE-2026-76519
• Canadian Centre for Cyber Security — AV26-1042 Update 1
• The Hacker News — Cisco Warns of Active Attacks, 14 October 2026
• BleepingComputer — Cisco patches new Secure Email Gateway zero-day, 14 October 2026
• SecurityWeek — Cisco Warns of Exploited Secure Email Gateway Vulnerability, 15 October 2026
• Palo Alto Networks — CVE-2026-0322
• CISA KEV — CVE-2026-0322
• [RWP — Cisco SEG CVE-2026-76461, 15 September 2026](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/)
• [RWP — Ivanti CVE-2026-104935, 14 October 2026](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/)
• [RWP — AhsayCBS CVE-2026-105134, 11 October 2026](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/)