Cisco Secure Email Gateway: path traversal exploited, CVSS 9.8

📌 Later developments: Cisco Secure Email Gateway zero-day: fixed releases and IoCs (October 14, 2026)

On 14 October 2026 CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog. It is a vulnerability in Cisco Secure Email Gateway, in the Advanced Malware Protection (AMP) feature. A remote, unauthenticated attacker can write arbitrary files to the gateway’s operating system and execute commands with root privileges by sending an email with a crafted attachment. Severity is critical: CVSS 3.1 9.8.

Inclusion in the KEV catalog means CISA has evidence of active exploitation. On the same day NCSC-NL, the national cyber security centre of the Netherlands, also published an advisory on the vulnerability.

What happened

CISA added CVE-2026-76519 to the KEV with the description “Cisco Secure Email Gateway Relative Path Traversal Vulnerability” and set 17 October 2026 as the deadline for US federal agencies: three days. In the catalog, use in ransomware campaigns is listed as “unknown”.

The advisory asks organisations to apply mitigations according to the vendor’s instructions, in line with directive BOD 26-04 on prioritising security updates based on risk and with CISA’s forensic triage requirements. For cloud services the same directive applies; if mitigations are not available, the product should be discontinued. The advisory also asks organisations to assess the internet exposure of each asset.

The NCSC-NL advisory (NCSC-2026-0429) is rated [H/H], meaning high likelihood and high impact on the agency’s scale, and its title states that the vulnerability has been fixed. The full text of the Dutch advisory was not available at the time of writing.

Neither CISA nor the NVD entry provides details on the attacks observed, the attackers or the victims.

Technical details

• CVE: CVE-2026-76519, published on 14 October 2026. The NVD entry is in “Undergoing Analysis” status: NIST has not yet completed its own assessment.
• Product: Cisco Secure Email Gateway, Advanced Malware Protection (AMP) feature. The Cisco advisory ID is cisco-sa-esa-afw-zqYJkjxp and it is listed among the references of the NVD entry.
• Condition: according to the description, the issue stems from improper handling of email attachments when the file reputation service is enabled.
• Mechanism: the attacker sends an email with a crafted attachment through the gateway. A successful exploit allows writing arbitrary files to the underlying operating system and executing commands with root privileges.
• Severity: CVSS 3.1 9.8 (critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score provided by Cisco. The vector indicates a network attack, low complexity, no privileges and no user interaction: nobody needs to open the attachment, because the gateway itself processes it.
• Weakness: CWE-23 (Relative Path Traversal), i.e. the use of relative path sequences to write outside the intended directory.
• Versions: the available sources do not list affected or fixed versions. The reference is the Cisco advisory.
• Indicators of compromise: none published in the sources.
• MITRE ATT&CK: for a gateway receiving mail from the internet, exploitation maps to technique T1190, Exploit Public-Facing Application.

Impact for European and Italian companies

The mail gateway is the first system to receive email addressed to the company and, by definition, it is reachable from the internet. According to the description, the attacker only needs to get an email with the crafted attachment through the gateway: no credentials and no employee mistake are required. A compromise with root privileges at the very point where inbound mail flows must be checked as a priority, in addition to updating.

The affected feature, attachment analysis with file reputation, is precisely the one companies enable to protect themselves from email-borne malware: those that turned it on are the ones matching the described condition.

For NIS2 entities the vulnerability falls under vulnerability management with documented priorities and timelines; if the gateway is managed by a provider, the check must be done together with them. A significant incident must be notified to the national CSIRT, which in Italy is CSIRT Italia at ACN. If the compromise affects emails containing personal data, it must also be assessed as a GDPR breach, with notification to the supervisory authority within 72 hours where required. In healthcare, where email often carries medical reports and health data, the check should be done without delay.

What to do now

1. Take inventory of your Cisco Secure Email Gateways, including those managed by providers, and the version of each.
2. Check the configuration: verify whether the AMP feature with the file reputation service is enabled, the condition stated in the CVE description.
3. Apply Cisco’s instructions: follow advisory cisco-sa-esa-afw-zqYJkjxp for fixed versions and any mitigations. If you plan to change the AMP configuration as a temporary measure, first check in the Cisco advisory whether it is a workaround indicated by the vendor.
4. If you cannot act immediately: as CISA requests, if mitigations are not available consider taking the device out of service.
5. Look for signs of exploitation: since the vulnerability is already exploited, updating is not enough. Check for unexpectedly created or modified files on the gateway, unusual processes and commands, anomalous outbound connections and messages with unusual attachments in the mail logs; use the verification procedures provided by Cisco, if any.
6. If you find signs of compromise: preserve logs and evidence for forensic analysis before reinstalling, then change the credentials, keys and certificates configured on the gateway.

How ARXDOME helps

ARX Expose checks the services your company exposes on the internet, the products it recognises and their known vulnerabilities, including mail systems reachable from outside. ARX Sentry collects logs and events from servers and firewalls in a central collector, so anomalous connections to and from the gateway remain recorded outside the device as well. ARX Horizon enriches events with threat lists and vulnerability information.

Last updated: 14 October 2026