Skip to content
VulniPulse
Sign in
Advisory severityCritical9.8Cisco Exploited CISA KEV Updated

Critical [CVE-2026-76519] Cisco Secure Email Gateway Arbitrary File Write Vulnerability

This critical-severity Cisco advisory covers CVE-2026-76519 affecting Secure Email.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

cisco-sa-esa-afw-zqYJkjxp Source published Source updated

VulniPulse record published Record updated

CVE-2026-76519
Affected products & platforms
CiscoUnclassified
Open source advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

An unauthenticated remote attacker could exploit a flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway to write arbitrary files on the underlying operating system. The flaw is caused by improper handling of email attachments when the file reputation service is enabled.

CISA Known Exploited Vulnerability

Listed:
Oct 14, 2026 · federal remediation due Oct 17, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • Scope: This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, if it is running a vulnerable release of Cisco AsyncOS Software and both of the following conditions are met:
  • Release 15.5 (first fixed: 15.5.5-014)
  • 16.0 — Migrate to a fixed release
  • Release 16.5 (first fixed: 16.5.0-780)

Official advisory · high-confidence parse· fetched 21 hours ago·verify at source

Fixed versions
  • 15.5.5-014
  • 16.5.0-780

Official advisory · high-confidence parse· fetched 21 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
  • Release 15.5: upgrade to 15.5.5-014.
  • Release 16.0: migrate to a fixed release.
  • Release 16.5: upgrade to 16.5.0-780.
Workaround status
  • There are no workarounds that address this vulnerability.

Official advisory · high-confidence parse· fetched 21 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.