CVE-2026-76519CiscoServers and softwareOctober 14, 2026

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

Critical 9.8Actively exploited

Description

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp For further documentation of improvements and fixes in Cisco Secure Email Gateway, see Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 . Security Impact Rating: Critical CVE: CVE-2026-76519

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Running Cisco devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Cisco alerts

Details

Vendor
Cisco
Product
Cisco Secure Email Gateway
CVE
CVE-2026-76519
Affected versions
Cisco Secure Email 14.0: 14.0.0-698
Cisco Secure Email 13.5: 13.5.1-277; 13.5.4-038
Cisco Secure Email 13.0: 13.0.0-392; 13.0.5-007
Cisco Secure Email 14.2: 14.2.0-620; 14.2.1-020
Cisco Secure Email 14.3: 14.3.0-032
Cisco Secure Email 15.0: 4 versions, from 15.0.0-104 to 15.0.5-016
Cisco Secure Email 15.5: 5 versions, from 15.5.0-048 to 15.5.4-012
Cisco Secure Email 16.0: 6 versions, from 16.0.0-050 to 16.0.4-016 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
9.8
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
Source
Cisco PSIRT – original advisory
Published
October 14, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Cisco advisories