CVE-2026-76519
Cisco Secure Email Gateway: Relative Path Traversal
As of , CVE-2026-76519 in Cisco Secure Email Gateway is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.
- Exploited
- Yes: CISA listed it on 14 October 2026
- US federal deadline
- 17 October 20263 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- Forensic triage
- Required by CISA under BOD 26-04Agencies must also look for signs that attackers already got in.
- EPSS when listed
- No score that dayThe EPSS file of the day CISA listed it has no score for it.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: sec.cloudapps.cisco.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA's required action
What the flaw is
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
CISA's description
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
The CVE record's description, from cisco
- CVE published
- 14 October 2026
- Assigned by
- cisco
- CVSS
- 9.8 Critical (CVSS 3.1, from the CNA)
- CWE-23
- Relative Path Traversal
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Secure Email Gateway: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2026-76461SQL Injection | Cisco Secure Email Gateway | Patch nowForensic triage required by CISA | 0.30 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov