An unauthenticated remote attacker can exploit a critical path traversal flaw in the AMP feature of Cisco Secure Email Gateway, using a crafted email attachment to write arbitrary files and run commands as root; CISA has confirmed active exploitation.
What Is It
CVE-2026-76519 is a relative path traversal vulnerability (CWE-23) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. The appliance mishandles email attachments when the file reputation service is enabled. An attacker sends an email with a crafted attachment through an affected device. If the exploit succeeds, the attacker can write arbitrary files to the underlying operating system and run commands with root privileges.
Cisco PSIRT rates it CVSS 3.1 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is network-based and low-complexity, and it needs no privileges and no user interaction.
Why It Matters
CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, which confirms active exploitation. CISA's SSVC assessment lists exploitation as "active," automatable as "yes," and technical impact as "total."
This is an email gateway, so the attacker only needs to get a message through the device. No login or user click is required. A successful exploit gives root-level command execution on a security appliance that sits at the network perimeter.
CISA has flagged this entry for forensic triage. Organizations should look for signs of compromise as well as patching. Known ransomware campaign use is listed as "Unknown."
What's Vulnerable
The NVD record (status: Undergoing Analysis) lists these Cisco Secure Email releases as affected:
- 13.x: 13.0.0-392, 13.0.5-007, 13.5.1-277, 13.5.4-038
- 14.x: 14.0.0-698, 14.2.0-620, 14.2.1-020, 14.3.0-032
- 15.x: 15.0.0-104, 15.0.1-030, 15.0.3-002, 15.0.5-016, 15.5.0-048, 15.5.1-055, 15.5.2-018, 15.5.3-022, 15.5.4-012
- 16.x: 16.0.0-050, 16.0.0-054, 16.0.1-017, 16.0.2-112, 16.0.3-044, 16.0.4-016
The vulnerable path is the AMP feature with the file reputation service enabled.
Patch Status
CISA requires agencies to apply mitigations according to Cisco's instructions by 2026-10-17. They must also follow BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If mitigations are unavailable, CISA directs organizations to follow the BOD 26-04 cloud services guidance or stop using the product. Stakeholders are responsible for assessing each asset's internet exposure.
The supplied data does not name fixed releases. See the Cisco advisory for remediated versions and workarounds.