CVE-2026-76519
Published on October 14, 2026
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Vulnerability Analysis
CVE-2026-76519 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Affected Versions
Cisco Secure Email:- Version 14.0.0-698 is affected.
- Version 13.5.1-277 is affected.
- Version 13.0.0-392 is affected.
- Version 14.2.0-620 is affected.
- Version 13.0.5-007 is affected.
- Version 13.5.4-038 is affected.
- Version 14.2.1-020 is affected.
- Version 14.3.0-032 is affected.
- Version 15.0.0-104 is affected.
- Version 15.0.1-030 is affected.
- Version 15.5.0-048 is affected.
- Version 15.5.1-055 is affected.
- Version 15.5.2-018 is affected.
- Version 16.0.0-050 is affected.
- Version 15.0.3-002 is affected.
- Version 16.0.0-054 is affected.
- Version 15.5.3-022 is affected.
- Version 16.0.1-017 is affected.
- Version 15.5.4-012 is affected.
- Version 16.0.4-016 is affected.
- Version 15.0.5-016 is affected.
- Version 16.0.2-112 is affected.
- Version 16.0.3-044 is affected.