Cisco Secure Email Gateway Relative Path Traversal Vulnerability Added to CISA KEV

What's on the official record

14 October — CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes a relative path traversal vulnerability (CWE-23) in Cisco Secure Email Gateway that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. CISA's remediation due date for federal civilian agencies is 17 October 2026. The record names no fixed version; the fix field points to the vendor advisory. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.016 probability of exploitation (75th percentile, 23 October 2026). CISA's ADP SSVC assessment records exploitation as active, automatable, with total impact.

Assessment

For a platform or AI-stack owner, the record lets you check whether Cisco Secure Email Gateway instances in your estate are running affected versions and apply the vendor's mitigations. Because the record names no fixed version, the decision is to follow the vendor advisory and patch, isolate, or pull affected versions before an unauthenticated remote write is attempted.

For a cyber underwriter, the record lets you check policyholders' estates against CVE-2026-76519 and the vendor advisory. You can decide whether to require a control or adjust pricing or exclusion for accounts running affected Cisco Secure Email Gateway versions.

What would change this call

A fixed version named by Cisco or CISA, or a change in the catalog's ransomware field.

What to check next

Confidence

Filed 25 October 2026 from the record dated 14 October 2026. The note is drawn from the CISA Known Exploited Vulnerabilities Catalog entry and the CVE record; EPSS and SSVC figures are attributed to FIRST's model and CISA's ADP respectively.

Sources

[1] Cisco Secure Email Gateway Relative Path Traversal Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-76519

[2] CVE record CVE-2026-76519 — https://www.cve.org/CVERecord?id=CVE-2026-76519

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog