# Cisco Secure Email Gateway flaw exploited in wild

Published: 2026-10-14 · Severity: severe · Sectors: technology
Canonical: https://vorant.io/reports/5f3fae66-efc3-5657-b2b2-6895d0fabf43/cisco-secure-email-gateway-flaw-exploited-in-wild

> Actively exploited path traversal in Cisco Secure Email Gateway's Advanced Malware Protection lets unauthenticated attackers write files and gain root.

NCSC-NL issued a high-priority advisory for CVE-2026-76519, a relative path traversal vulnerability in Cisco Secure Email Gateway's Advanced Malware Protection feature. The flaw occurs when the file reputation service is enabled and email attachments are processed, allowing an unauthenticated remote attacker to write arbitrary files to the underlying operating system. Successful exploitation can lead to command execution with root privileges, fully compromising system integrity.

Cisco has confirmed active exploitation in the wild and has shared Indicators of Compromise along with detailed background information to assist affected organizations. No public proof-of-concept or exploit code is currently known, but NCSC-NL assesses that one is likely to emerge shortly given the nature of the vulnerability, and expects a rise in scanning and exploitation attempts as a result.

Cisco has released patches to address the vulnerability. Defenders operating Cisco Secure Email Gateway with Advanced Malware Protection and file reputation services enabled should apply updates immediately, review the IoCs shared by Cisco, and monitor for anomalous file-write activity or unexpected processes running with elevated privileges on affected appliances.

## Mentioned in this report

- Vulnerabilities: CVE-2026-76519 (KEV)

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0429.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5f3fae66-efc3-5657-b2b2-6895d0fabf43/cisco-secure-email-gateway-flaw-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup