Read the docs
TI-2026-74174 Aliases CVE-2026-76519

Arbitrary file write in Cisco Secure Email Gateway via AMP feature

Priority CRITICAL 100Exploited in the wildCWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Cisco Secure Email Gateway's Advanced Malware Protection feature improperly handles email attachments when the file reputation service is enabled, a relative path traversal flaw (CWE-23). An unauthenticated remote attacker can send an email with a crafted attachment through an affected device to write arbitrary files and execute commands with root privileges on the underlying operating system. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-14.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-14CISA due date 2026-10-17
EPSS 0.06227 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Secure Email14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 16.0.0-050; 15.0.3-002; 16.0.0-054; 15.5.3-022; 16.0.1-017; 15.5.4-012; 16.0.4-016; 15.0.5-016; 16.0.2-112; 16.0.3-044—No fix listedCNA
  • Cisco Secure Email VendorCisco Affected 14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 16.0.0-050; 15.0.3-002; 16.0.0-054; 15.5.3-022; 16.0.1-017; 15.5.4-012; 16.0.4-016; 15.0.5-016; 16.0.2-112; 16.0.3-044 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*15.0 to before 15.5.5-014; 16.0 to before 16.5.0-780VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* Versions 15.0 to before 15.5.5-014; 16.0 to before 16.5.0-780 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

The sources list no fixed version for Cisco Secure Email. CISA requires U.S. federal agencies to fix it by 2026-10-17.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Added to CISA KEV
  2. 2026-10-15 Threatist record created from CVE-2026-76519
  3. 2026-11-06 EPSS moved to the 90th–95th percentile

References

Advisory 1

  • TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-14683 Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-13698 Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2018-11020 Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2019-01567 Cisco Email Security Appliance Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2019-01508 Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability CVSS 3.1HIGH 8.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences