Cisco Warns of Exploited Secure Email Gateway Vulnerability

CVE-2026-76440 groups multiple path traversal weaknesses (CWE Pillar CWE-23) found during Cisco's internal security review of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, addressed via software hardening releases. With a CVSS 3.1 base score of 9.8 (network vector, low attack complexity, no privileges, no user interaction), a remote unauthenticated attacker could craft requests that escape intended directory boundaries to read, modify, or delete files on the appliance, potentially leading to full confidentiality, integrity, and availability impact. Any organization running an affected version of these email perimeter appliances is exposed, particularly since these gateways are designed to be internet-facing. No public proof-of-concept exists, the flaw is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date. Because the bugs were internally discovered, technical detail is limited and defenders should prioritize patching rather than await exploit intelligence.

Do: Apply the software hardening release identified in Cisco's advisory for both Cisco Secure Email Gateway and Cisco Secure Email and Web Manager as soon as maintenance windows allow, given the unauthenticated 9.8 rating. Restrict the web management interface to trusted admin networks or VPN so only SMTP ports are exposed to the internet. Review appliance logs for unexpected file access, anomalous admin activity, or unfamiliar file modifications that could indicate prior probing.

Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.

Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.

CVE-2026-76519 is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment that the gateway mishandles. A successful attack can write arbitrary files on the underlying operating system and execute commands as root. Cisco Secure Email Gateway deployments that use this AMP/file reputation feature are affected; specific version ranges are not listed in the source data. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14, Cisco has urged customers to patch and check for compromise, and a public proof-of-concept reference exists; ransomware use is listed as unknown.

Do: Apply Cisco's fixes or mitigations for CVE-2026-76519 immediately, and follow CISA BOD 26-04 (including forensics triage). Treat appliances with Advanced Malware Protection or file reputation enabled as potentially compromised: review for unexpected files and root-level command execution, and isolate or discontinue use if a vendor fix is unavailable.