1.0 Introduction
Recently, Cisco has released security updates to address a critical vulnerability (CVE-2026-76519) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway.
2.0 Impact
Successful exploitation may allow an unauthenticated remote attacker to trigger elevation of privilege, remote code execution and data manipulation on the targeted system. The flaw is caused by improper handling of email attachments when the file reputation service is enabled. An attacker could send an email containing a crafted attachment through an affected device to write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco notes that private SSH keys used for authentication between cluster members could be accessed on a compromised appliance, which may allow the attacker to compromise other cluster members.
3.0 Affected Products
- The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
- The Content Scanner Tools version is earlier than 25.3.0.5525.
4.0 Recommendations
CyberSecurity Malaysia urges users and administrators to apply the latest security updates from Cisco as soon as possible. Where the vulnerable feature is not needed, administrators can reduce exposure by disabling it. As a precaution, systems that were unpatched during the attack period should be checked for compromise.
Kindly refer to the following URL:
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp