CVE-2026-76519 Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

1. Executive summary

CVE-2026-76519 is a relative path traversal flaw (CWE-23) in Cisco Secure Email Gateway that lets an unauthenticated, remote attacker write arbitrary files to the underlying operating system. NVD records it at CVSS 9.8 CRITICAL. It is not in CISA KEV, and the source material gives no evidence of exploitation in the wild. The risk to EMEA financial services is concentrated in the same appliance class that has already been attacked this quarter: CVE-2026-76461, a separate Cisco SEG SQL injection flaw, was added to KEV on disclosure day and exploited as a zero-day, which shows that internet-facing SEG appliances are an active target and that a file-write primitive on the same product is worth treating as pre-exploitation. The source names no fixed version for CVE-2026-76519, so the immediate action is to confirm exposure and apply vendor mitigations rather than assume a patch exists.

2. Regulatory framing

No DORA incident-reporting article is engaged on the facts available: the source records no exploitation, no confirmed compromise and no service disruption. If exploitation is later confirmed, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become relevant at that point.

3. Technical analysis & attack chain

CVE-2026-76519 is a relative path traversal vulnerability in Cisco Secure Email Gateway. The source states that it could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. NVD classifies it as CWE-23 (relative path traversal) and scores it CVSS 9.8 CRITICAL. It is not listed in CISA KEV.

The confirmed steps, from the source, are limited:

1. An unauthenticated, remote attacker reaches the Cisco Secure Email Gateway.
2. The attacker supplies input that traverses a relative path.
3. The traversal allows the attacker to write arbitrary files on the underlying operating system.

That is the full extent of what the primary source supports. It does not name the affected AsyncOS versions, the fixed versions, the vulnerable component, the protocol or port used, or whether the write primitive reaches a location that yields code execution. The advisory does not fill those gaps.

What the source does establish is the exposure profile of the product. Cisco Secure Email Gateway, formerly IronPort Email Security Appliance, inspects inbound and outbound email for phishing, malware, spam and business email compromise. Because it processes externally delivered email as part of normal operation, exploitation does not require access to an administrative interface or authentication. That description comes from Rapid7's write-up of the separate CVE-2026-76461, but it describes the same product and the same unauthenticated, remote access path, so it applies to how CVE-2026-76519 would be reached.

The related CVE-2026-76461 is the reason this item warrants attention now. It is a SQL injection flaw in Cisco AsyncOS for Cisco Secure Email Gateway that allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges. Cisco published its advisory on 14 September 2026. CISA added CVE-2026-76461 to KEV the same day, which Rapid7 reads as evidence it was exploited as a zero-day before disclosure. Cisco's PSIRT became aware of active exploitation in September 2026. Rapid7 states there is no public proof-of-concept exploit code and no attribution for the activity. Fixed versions for CVE-2026-76461 are 15.5.5-014 for 15.5 and earlier, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5, with Cisco recommending migration to 16.5.0-780.

Two caveats on that related material. First, CVE-2026-76461 and CVE-2026-76519 are distinct CVEs; nothing in the source states that exploitation of the SQL injection flaw involved the path traversal flaw, or that the same actor is using both. Second, the exploitation and zero-day characterisation of CVE-2026-76461 rests on Rapid7's reporting and the KEV listing; treat the attribution and the "exploited as a zero-day" reading as single-sourced to Rapid7 and verify before relying on it. No actor is named anywhere in the source material, and no MITRE ATT&CK profile is available for any actor in this item, so no attribution is made.

CISA's required action for CVE-2026-76519 directs organisations to apply mitigations per vendor instructions, follow BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable, and evaluate each asset's internet exposure. The source records a due date of 2026-10-17. Known ransomware campaign use is recorded as Unknown. The source does not state that CVE-2026-76519 is in KEV, and it is not.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Cisco Secure Email Gateway instance and record its AsyncOS version. The source gives no affected or fixed version for CVE-2026-76519, so version data has to come from the vendor advisory, not from this note.
• Check the vendor advisory for CVE-2026-76519 for a fixed AsyncOS build. If one exists, apply it outside the normal patch cycle, as Rapid7 advised for the related SEG flaw. If none exists, apply the vendor's stated mitigations and treat the appliance as exposed.
• Determine internet exposure for each gateway. The source's required action makes exposure evaluation the organisation's responsibility. Gateways that accept mail from the internet are the exposed set.
• Restrict management access to the gateway to a dedicated management network or jump host, and confirm the administrative interface is not reachable from the internet. This does not close the unauthenticated mail-path vector, but it removes a second route in.

P2 (within 72 hours)

• If the vendor names no fix and no mitigation, evaluate whether the gateway can be taken out of the inbound mail path or replaced. The source's required action explicitly contemplates discontinuing use of the product where mitigations are unavailable.
• Review mail_logs on every gateway, and on every node if the device is in a cluster. Rapid7's detection guidance for the related CVE-2026-76461 is to look for suspicious SQL statements, with this non-exhaustive example:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

Any entry in the output may indicate malicious activity. This grep targets the SQL injection flaw, not the path traversal flaw, so it will not detect CVE-2026-76519 exploitation on its own. Run it anyway: it establishes whether the same appliance has already been touched by the activity that is confirmed in the wild.

• Apply the fixed versions for CVE-2026-76461 if they are not already in place: 15.5.5-014, 16.0.4-302, or 16.5.0-780. Cisco recommends 16.5.0-780. This is a separate CVE with confirmed exploitation, and it should not wait behind the unpatched path traversal flaw.
• Alert on unexpected file creation or modification in the gateway's filesystem, particularly in directories the mail-processing service can write to. The source does not name those paths, so scope this from the appliance's own filesystem layout.

P3 (within 7 days)

• Add CVE-2026-76519 to the vulnerability management baseline and re-check the vendor advisory on a defined cadence until a fixed version is named.
• Confirm the third-party risk file for this gateway records the current version, the patch channel, and the provider's notification commitment, per DORA Art. 28 and NIS2 Art. 21(2)(d).
• If the gateway is managed by a third party, request written confirmation of the version in service and the remediation timeline.

5. Indicators of compromise

No atomic indicators of compromise for CVE-2026-76519 are present in the source material. The source provides no hashes, domains, IP addresses, file paths or filenames tied to this CVE.

The only observable behaviour described in the related material is a log pattern for the separate CVE-2026-76461, reproduced below as a behavioural indicator. It is not an indicator for CVE-2026-76519.

Behavioural indicators

No copyable indicator block is provided: there are no machine-pivotable atomic indicators in the source material.

6. Detection

The source material contains no artefacts of CVE-2026-76519 itself: no strings, command-line flags, filenames, paths, registry keys or hard-coded values. The only concrete artefact in the related material is the SQL log pattern for CVE-2026-76461, which is a detection for a different vulnerability. A YARA rule built on that pattern would not detect CVE-2026-76519, and a rule built on the CVE identifier or the product name would detect reporting about the flaw rather than the flaw.

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-76519 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-76519, published 2026-10-13
• CISA Known Exploited Vulnerabilities, CVE-2026-76461 (Cisco Secure Email Gateway SQL injection), https://nvd.nist.gov/vuln/detail/CVE-2026-76461, due date 2026-09-17
• The Hacker News, Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution, https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html
• Rapid7, CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild, https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild, initial publication 2026-09-15
• Sophos, Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation, https://www.sophos.com/en-gb/blog/cisco-secure-email-gateway-vulnerability-cve-2026-76461-in-active-exploitation
• SecurityWeek, Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation, https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/
• CISA Known Exploited Vulnerabilities, CVE-2026-20079 (Cisco FMC and SCC Firewall Management authentication bypass), https://nvd.nist.gov/vuln/detail/CVE-2026-20079, due date 2026-09-12

8. Adverse Trace position

Adverse Trace assesses CVE-2026-76519 at CVSS 9.8 CRITICAL per NVD, not in CISA KEV, with no exploitation observed in the source material. The severity is high but the evidence base is thin: the source gives no affected versions, no fixed versions and no exploitation status, so the practical risk to a client depends entirely on whether their gateway is internet-facing and whether the vendor has shipped a fix. The related CVE-2026-76461 is the more urgent item for any client running Cisco SEG, because it is in KEV, was exploited as a zero-day, and has named fixed versions. We will re-check the vendor advisory for CVE-2026-76519 and issue an update when a fixed version or exploitation evidence appears. Clients who cannot confirm their SEG version and exposure by 2026-10-17 should contact us.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.