Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA lists Cisco email gateway file-write flaw in KEV (CVE-2026-76519)

Original title: CISA KEV: Cisco Secure Email Gateway Relative Path Traversal Vulnerability — Cisco Secure Email Gateway (CVE-2026-76519)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
AI summary · x-ai/grok-4.7Summaries by Vani AI

With file reputation enabled, a crafted email attachment can write files and run root commands; federal action is due October 17.

CISA added CVE-2026-76519, a relative path-traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway, to the Known Exploited Vulnerabilities catalog. An unauthenticated remote attacker can send a crafted attachment when file reputation is enabled, write arbitrary files, and execute commands as root. No fixed version is stated. The required action date is October 17, 2026, and ransomware use is unknown.

Unconfirmed: The entry does not name a fixed version, specific incidents, or ransomware use, which is listed as unknown.

Key facts
  • The flaw is in AMP handling of email attachments.
  • Exploitation requires the file reputation service to be enabled.
  • A successful exploit yields root command execution on the appliance OS.
  • No patched version is named in the catalog entry.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated arbitrary file write and root command execution

ProductAffected
Cisco Secure Email Gateway—
What to do
  1. 1.Apply vendor mitigations and meet BOD 26-04 by October 17, 2026.
  2. 2.Discontinue use if mitigations are unavailable.
  3. 3.Follow CISA forensics triage requirements for affected assets.
Analyze CVE-2026-76519 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-76519
ATT&CK
T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting Interpreter
Tags
ciscosecure-email-gatewaykevpath-traversalemail-security
Vendors
Cisco
Products
Cisco Secure Email Gateway
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-76519
Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
9.82%KEVPoC
KEV

From the original article

1 min read at cisa.gov

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.