Cisco Secure Email Gateway path traversal added to CISA KEV (CVE-2026-76519)
At a glance
| Severity | CRITICAL |
|---|---|
| In CISA KEV (exploited) | Yes, due 2026-10-17 |
| Vendor | Cisco |
| CVE IDs | CVE-2026-76519 |
CISA added a Cisco Secure Email Gateway vulnerability, CVE-2026-76519, to its Known Exploited Vulnerabilities (KEV) catalog on 14 October 2026, which means the Cisco Secure Email Gateway vulnerability is being exploited in the wild. Federal agencies must act by 17 October 2026, and every other organisation running the product should treat that date as a sensible target too. See the CISA KEV entry for the original listing.
What happened
CISA catalogues the issue as a relative path traversal vulnerability in Cisco Secure Email Gateway. According to the KEV entry, an unauthenticated, remote attacker could use it to write arbitrary files on the underlying operating system.
An arbitrary file write on an email security appliance is serious because the device sits on the mail path and usually has broad network reach. Which files can be written, and what an attacker does with that ability, has not been disclosed in the source data.
- Vendor and product: Cisco, Secure Email Gateway
- Weakness: relative path traversal
- Date added to KEV: 14 October 2026
- CISA due date: 17 October 2026
- Known ransomware campaign use: Unknown
Am I affected?
The KEV entry names the product but the data we have does not list affected or fixed versions, and no NVD details were available when this was written. Affected versions: not disclosed here. Check Cisco’s own advisory for the exact releases and fixes before you decide a deployment is safe.
Assume exposure if you run the gateway as a physical, virtual or cloud-hosted appliance and any of its management or mail-handling interfaces can be reached from untrusted networks. The CISA text asks stakeholders to evaluate each asset’s internet exposure.
Technical details
- Attack vector: remote, unauthenticated, per the CISA description. A CVSS score and EPSS value were not available in our data.
- Exploitation status: exploited, as shown by the KEV listing. Details of the attacks, including who is behind them, are not disclosed.
- Reference: NVD record for CVE-2026-76519.
In plain terms, path traversal means the application accepts a file path containing sequences that step outside the folder it should be confined to. Combined with a write operation, that lets an attacker place a file wherever the service account has permission.
Why this matters
This section is our analysis, not new reporting.
Email gateways are attractive targets: they are internet-facing by design, they handle sensitive traffic, and they are often trusted by the rest of the network. An unauthenticated file write on such a device can be a stepping stone to persistence or code execution, although the source data does not say that happens here.
The short deadline is the practical signal. A three-day window between listing and due date tells you CISA considers the risk immediate, so a normal monthly patch cycle is too slow. If the appliance is reachable from the internet, plan to mitigate within hours, not days.
Note also that the required action points to vendor mitigations and to CISA’s forensics triage requirements. That wording suggests defenders should check for signs of prior compromise as well as closing the hole.
How to fix CVE-2026-76519
- Find every instance. List all Cisco Secure Email Gateway appliances, virtual machines and cloud services, including test and disaster-recovery units.
- Apply the vendor mitigations. Follow Cisco’s instructions as required by CISA. If no mitigation is available for a deployment, CISA’s guidance is to discontinue use of the product.
- Reduce exposure. Restrict management interfaces to trusted administration networks and review which interfaces face the internet.
- Hunt for compromise. Review the appliance for unexpected or recently modified files, new accounts, changed configuration and unusual outbound connections, starting from before 14 October. Preserve logs and snapshots first.
- Check mail flow. Look for unexplained changes to mail routing, filtering rules or quarantine behaviour.
- Escalate if you find anything. Treat a suspected compromise of the gateway as an incident: rotate credentials and keys stored on or used by the device, and follow your incident response plan.
What to do
Prioritise this above routine patching. Confirm exposure today, apply the Cisco mitigation, and record the date you completed it so you can show you met the 17 October deadline. Track the vendor and CISA pages for updates, since the version details and exploitation specifics are not yet in the data available to us.
We will update this article if CISA or Cisco publish further information.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
