CVE Details

CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Published: 2026-10-14 CVSS: 9.8 CRITICAL Product: Cisco Secure Email Gateway Due Date: 2026-10-17

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • Mickysalivan/CVE-2026-76519-POC • ⭐ 0 • 2026-10-14 • Conf: 90.0%
  • Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.8
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-76519
cveMetadata > assignerOrgId d1c1063e-7a18-46af-9102-31f8928bc633
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName cisco
cveMetadata > dateReserved 2026-08-19T12:02:03.642Z
cveMetadata > datePublished 2026-10-14T16:07:51.466Z
cveMetadata > dateUpdated 2026-10-14T19:58:23.605Z
containers > cna > title Cisco Secure Email Gateway Arbitrary File Write Vulnerability
containers > cna > metrics > 0 > format cvssV3_1
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > baseScore 9.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
containers > cna > references > 0 > url https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
containers > cna > references > 0 > name cisco-sa-esa-afw-zqYJkjxp
containers > cna > exploits > 0 > lang en
containers > cna > exploits > 0 > value In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
containers > cna > source > advisory cisco-sa-esa-afw-zqYJkjxp
containers > cna > source > discovery INTERNAL
containers > cna > source > defects > 0 CSCwu56223
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > description Relative Path Traversal
containers > cna > problemTypes > 0 > descriptions > 0 > type cwe
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-23
containers > cna > affected > 0 > vendor Cisco
containers > cna > affected > 0 > product Cisco Secure Email
containers > cna > affected > 0 > versions > 0 > version 14.0.0-698
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 1 > version 13.5.1-277
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 2 > version 13.0.0-392
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 3 > version 14.2.0-620
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 4 > version 13.0.5-007
containers > cna > affected > 0 > versions > 4 > status affected
containers > cna > affected > 0 > versions > 5 > version 13.5.4-038
containers > cna > affected > 0 > versions > 5 > status affected
containers > cna > affected > 0 > versions > 6 > version 14.2.1-020
containers > cna > affected > 0 > versions > 6 > status affected
containers > cna > affected > 0 > versions > 7 > version 14.3.0-032
containers > cna > affected > 0 > versions > 7 > status affected
containers > cna > affected > 0 > versions > 8 > version 15.0.0-104
containers > cna > affected > 0 > versions > 8 > status affected
containers > cna > affected > 0 > versions > 9 > version 15.0.1-030
containers > cna > affected > 0 > versions > 9 > status affected
containers > cna > affected > 0 > versions > 10 > version 15.5.0-048
containers > cna > affected > 0 > versions > 10 > status affected
containers > cna > affected > 0 > versions > 11 > version 15.5.1-055
containers > cna > affected > 0 > versions > 11 > status affected
containers > cna > affected > 0 > versions > 12 > version 15.5.2-018
containers > cna > affected > 0 > versions > 12 > status affected
containers > cna > affected > 0 > versions > 13 > version 16.0.0-050
containers > cna > affected > 0 > versions > 13 > status affected
containers > cna > affected > 0 > versions > 14 > version 15.0.3-002
containers > cna > affected > 0 > versions > 14 > status affected
containers > cna > affected > 0 > versions > 15 > version 16.0.0-054
containers > cna > affected > 0 > versions > 15 > status affected
containers > cna > affected > 0 > versions > 16 > version 15.5.3-022
containers > cna > affected > 0 > versions > 16 > status affected
containers > cna > affected > 0 > versions > 17 > version 16.0.1-017
containers > cna > affected > 0 > versions > 17 > status affected
containers > cna > affected > 0 > versions > 18 > version 15.5.4-012
containers > cna > affected > 0 > versions > 18 > status affected
containers > cna > affected > 0 > versions > 19 > version 16.0.4-016
containers > cna > affected > 0 > versions > 19 > status affected
containers > cna > affected > 0 > versions > 20 > version 15.0.5-016
containers > cna > affected > 0 > versions > 20 > status affected
containers > cna > affected > 0 > versions > 21 > version 16.0.2-112
containers > cna > affected > 0 > versions > 21 > status affected
containers > cna > affected > 0 > versions > 22 > version 16.0.3-044
containers > cna > affected > 0 > versions > 22 > status affected
containers > cna > affected > 0 > defaultStatus unknown
containers > cna > providerMetadata > orgId d1c1063e-7a18-46af-9102-31f8928bc633
containers > cna > providerMetadata > shortName cisco
containers > cna > providerMetadata > dateUpdated 2026-10-14T16:07:51.466Z
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-76519
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-14T19:32:49.377572Z
containers > adp > 0 > metrics > 1 > other > type kev
containers > adp > 0 > metrics > 1 > other > content > dateAdded 2026-10-14
containers > adp > 0 > metrics > 1 > other > content > reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-14T19:58:23.605Z
containers > adp > 0 > timeline > 0 > time 2026-10-14T00:00:00.000Z
containers > adp > 0 > timeline > 0 > lang en
containers > adp > 0 > timeline > 0 > value CVE-2026-76519 added to CISA KEV