CVE-2026-76519criticalunder attackCWE-23

CVE-2026-76519: critical vulnerability in Cisco Secure Email

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

Published · Updated

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 1.6%
from disclosure to weapon0 days
Published on NVDOct 14
1st PoCOct 14
CISA KEVOct 14
exploitation probability
1.6%top 25% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2026-10-17

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in Cisco Secure Email Gateway allows an attacker to send a specially crafted email attachment that can write files anywhere on the server and run commands with top-level privileges, without needing to log in.

Technical detail

The vulnerability exists in the Advanced Malware Protection (AMP) feature due to improper validation of email attachments when file reputation service is enabled. An unauthenticated remote attacker can exploit this via a crafted attachment to achieve arbitrary file write and command execution with root privileges on the underlying OS (CWE-23: Relative Path Traversal).

Summary generated and translated by AI from the official description.
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Secure Email
public PoCs found — 2
githubgithub.com/Mickysalivan/CVE-2026-76519-POC★ 0githubgithub.com/Mickysalivan/CVE-2026-76519-Proof-of-concept★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Secure Email

In the same product, most dangerous first.

CVE-2025-20393CRITICALCisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityEPSS 32.4%KEVCVE-2026-76461CRITICALCisco Secure Email Gateway SQL Injection VulnerabilityEPSS 29.5%KEVCVE-2024-20401CRITICALCVE-2024-20401EPSS 2.3%CVE-2023-20009MEDIUMCVE-2023-20009EPSS 1.3%CVE-2022-20942MEDIUMCVE-2022-20942EPSS 1.0%CVE-2025-20184MEDIUMCisco Secure Email and Web Manager and Secure Web Appliance Command Injection VulnerabilityEPSS 0.9%
References
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxphttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519