CVE-2026-76519
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…
CISA federal remediation date Oct 17
Vulnerabilities · 17h ago
Cisco said on 14 October 2026 that CVE-2026-76519 in Secure Email Gateway is being actively exploited, and the flaw can let an unauthenticated attacker write files and run commands as root on affected appliances. CERT-EU said the issue affects the AMP file-reputation path in Cisco Secure Email Gateway when the Content Scanner Tools package is older than 25.3.0.5525.
The bug is a relative path traversal in how the gateway handles a crafted email attachment. If the file-reputation feature is enabled, a malicious message can steer the appliance into writing where it should not, turning mail inspection into full device compromise. On clustered gateways, Cisco says that compromise may expose private SSH keys used between members, which can let an attacker move into other nodes and hide evidence on the way.
That makes the trust boundary the appliance itself: a mail filter that sits in front of the inbox can become a foothold into the mail-security cluster. For any organization running internet-reachable Secure Email Gateway appliances, the remaining exposure is broader than one box if cluster credentials or shared trust material were already reachable from the device.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…
CISA federal remediation date Oct 17
4 sources covering this story
Cisco warns of actively exploited Secure Email Gateway flaw
Cisco released software updates to address the flaw, but warns that there are no workarounds that address the vulnerability.
Cisco Security Advisory: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Part of the PlainSec briefing for 2026-10-16