Cisco Secure Email Gateway Relative Path Traversal Vulnerability
TL;DR 📌
- Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-10-14) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-76519.
What it is
CVE-2026-76519 is a relative path traversal flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. It sits in the file reputation service that inspects email attachments.
The issue stems from improper handling of email attachments when file reputation checking is enabled. An unauthenticated, remote attacker can send an email containing a crafted attachment through an affected device. Because of the path traversal weakness, the attachment-handling code can be made to write files outside its intended directory, onto the underlying operating system.
The impact is severe: successful exploitation allows arbitrary file writes and command execution with root privileges. No authentication, no user interaction, and no prior access are required — the attacker only needs the gateway to process an email attachment with AMP/file reputation enabled. This is a data-plane attack delivered via normal mail flow rather than a management-interface issue.
The vulnerability is listed in CISA’s KEV catalogue, added 14 October 2026, so it is known to be exploited.
What to do
- Check whether AMP / file reputation is enabled on your Secure Email Gateway instances — this is the specific feature path that must be reachable for exploitation.
- Consult the Cisco advisory for this CVE directly for fixed software versions; none are listed in the summary data reviewed here, so do not assume a particular release addresses it without confirming against the advisory.
- Given the KEV listing, treat this as a priority patching action once Cisco publishes a fix, rather than deferring to a routine maintenance window.
- As an interim mitigation, consider disabling the file reputation service on internet-facing gateways if operationally acceptable, since this removes the vulnerable code path until a fix is applied.
- Review gateway logs and any AMP/file reputation audit trails for unexpected file writes to the underlying OS, particularly in directories outside normal mail-processing paths.
- Restrict or monitor root-level process activity on the gateway appliance, since successful exploitation grants root privileges.
For leadership 🧭
Executive summary. Any Secure Email Gateway running AMP file reputation checking can be forced to write files outside its intended folders and hand an attacker root access, triggered simply by sending it an email - no credentials or user action needed. This is already listed as exploited in the wild, so it needs same-day attention rather than waiting for the next change window.
Why it matters:
- The flaw sits in the AMP file reputation service that inspects every attachment passing through the gateway, so any device with that feature on is reachable by normal inbound mail.
- Exploitation needs no authentication and no user interaction - a single crafted attachment delivered through standard mail flow is enough to trigger arbitrary file writes.
- A successful write-primitive here converts directly into command execution with root privileges on the gateway’s underlying operating system, not just the mail-processing application.
- CISA has added this to its Known Exploited Vulnerabilities catalogue, confirming it is being used against targets now rather than being a theoretical risk.
Now / Next / Later:
- Now: Check every Secure Email Gateway deployment for whether AMP/file reputation is enabled, since that is the specific feature path an attacker needs reachable.
- Next: If disabling file reputation checking is operationally tolerable, turn it off on internet-facing gateways as an interim block, and review gateway and AMP audit logs for unexpected file writes outside normal mail-processing directories.
- Later: Apply Cisco’s fixed release for this CVE as soon as it is published, treating it as a priority patch given the KEV listing, and add monitoring for root-level process activity on the gateway appliance as a standing control.