Cisco security advisory (AV26-1042) – Update 1

CVE-2026-76519 is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment that the gateway mishandles. A successful attack can write arbitrary files on the underlying operating system and execute commands as root. Cisco Secure Email Gateway deployments that use this AMP/file reputation feature are affected; specific version ranges are not listed in the source data. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14, Cisco has urged customers to patch and check for compromise, and a public proof-of-concept reference exists; ransomware use is listed as unknown.

Do: Apply Cisco's fixes or mitigations for CVE-2026-76519 immediately, and follow CISA BOD 26-04 (including forensics triage). Treat appliances with Advanced Malware Protection or file reputation enabled as potentially compromised: review for unexpected files and root-level command execution, and isolate or discontinue use if a vendor fix is unavailable.