CVE-2026-76519
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
CISA due Oct 17, 2026
- Cisco Secure Email Gateway
- Critical
- CVSS 9.8
- EPSS 1.57%
- No fixed version listed
What to do
No fixed version listed
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- CISA deadline for US federal agencies
- Oct 17, 2026
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Secure Email | 14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 16.0.0-050; 15.0.3-002; 16.0.0-054; 15.5.3-022; 16.0.1-017; 15.5.4-012; 16.0.4-016; 15.0.5-016; 16.0.2-112; 16.0.3-044 | None listed |
Scores and signals
- Exploitation
- Exploited in the wild
- Severity
- Critical, CVSS 9.8 (v3.1, scored by cisco)
- EPSS
- 1.57% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 23, 2026)
- CISA's SSVC decision points
- Exploitation: active. Automatable: yes. Technical impact: total. As of Oct 14, 2026.
- Weakness
- CWE-23: Relative Path Traversal
- Vendor
- Cisco, Secure Email Gateway
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog: exploited in the wild. US federal agencies must remediate by 2026-10-17.