What happened
Reports indicate a critical vulnerability affecting Cisco Secure Email Gateway has been actively exploited in the wild. The flaw, identified as CVE-2026-76519, permits an unauthenticated, remote attacker to conduct a relative path traversal attack. This can lead to the attacker writing arbitrary files on the underlying operating system, potentially resulting in further exploitation or system compromise. The vulnerability stems from a weakness classified as CWE-23, which involves improper neutralisation of special elements used in a directory traversal attack.
The vulnerability has been confirmed as actively exploited, underscoring the importance of prompt mitigation measures. Patches and specific remediation steps are not yet available; instead, authorities recommend applying mitigations in accordance with vendor instructions and within the framework of CISA’s guidance on prioritising security updates based on risk. Organisations are advised to evaluate the internet exposure of affected assets and to adhere strictly to BOD 26-04 patching guidelines or to consider discontinuing use of the affected product if mitigations cannot be applied.
It is important to note that effective exploitation relies on specific attack vectors available over networks, which indicates the necessity of implementing appropriate network security controls and monitoring for signs of unusual activity related to this vulnerability.
Who is affected
Organizations running Cisco Secure Email Gateway deployed in public or internet-connected environments should assume vulnerability exposure.
Any affected deployments exposed to untrusted networks or the internet are at increased risk of exploitation.
The vulnerability’s active exploitation means that unmitigated systems are particularly vulnerable to compromise, data breaches, or further malicious activity.
Recommended actions
Apply mitigations as specified by Cisco, following vendor instructions.
Ensure compliance with CISA’s BOD 26-04 guidance on prioritising essential security updates and patches within the stipulated timeline.
Evaluate each deployment’s internet exposure, prioritising those with direct internet connectivity or minimal network controls, for immediate action.
If mitigation measures are unavailable, consider discontinuing use of the affected product to reduce risk exposure.
