CVE-2026-76519

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

CVSS

9.8

EPSS

—

CISA KEV

Added 2026-10-14, due 2026-10-17

Exploitation

active

Public exploits

None seen

State

PUBLISHED

Coverage

• ● Actively exploitedCritical 100CISA advisories & alerts◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards14 hours ago

  CISA Adds Four Known Exploited Vulnerabilities to Catalog

  CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability…

  ↗cisa.gov/news-events/alerts/2026/10/14/cisa-add…(opens the publisher's site in a new tab)

What we observed

1. 14 Oct, 19:40kev addedcisa-kev