SB2026101538 - Arbitrary file upload in Cisco Secure Email Gateway

Description

This security bulletin contains information about 1 vulnerability.

1) Relative Path Traversal (CVE-ID: CVE-2026-76519) Exploited

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

The vulnerability exists due to improper handling of email attachments in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway when processing email messages. A remote attacker can send an email containing a crafted attachment through an affected device to write arbitrary files and execute commands with root privileges on the underlying operating system.

Exploitation requires the File Reputation service to be enabled and assigned to a mail policy.

Note, the vulnerability is being actively exploited in the wild.

Remediation

Install update from vendor's website.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu56223