CVE-2026-76519: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Other sources
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of Cisco Secure Email Gateway if mitigations are unavailable.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Cisco Secure Email Gateway devices with the Advanced Malware Protection feature and the file reputation service enabled are exposed. The attack can be performed remotely without authentication or user interaction by sending a crafted email attachment through the device.
What level of access could a successful attacker obtain?
A successful exploit can allow arbitrary file writes on the underlying operating system and command execution with root privileges.
What configuration condition is required for exploitation?
The file reputation service must be enabled, because the flaw is caused by improper handling of email attachments when that service is enabled.