CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

According to BleepingComputer, the flaw tracked as CVE-2026-76519 stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments.[1]Cisco said in its Wednesday advisory, as quoted by BleepingComputer, that a successful exploit could allow the attacker to "write arbitrary files and execute commands with root privileges on the underlying operating system"[1]. The company also said "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."[1]The Hacker News reports that Cisco found the flaw, which has a CVSS score of 9.8, through its own internal security scanning[2]. The outlet adds that the advisory does not say how many devices were attacked, who is behind the attacks, or whether the attackers obtained root on any of them.[2]According to BleepingComputer, the bug affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.[1]BleepingComputer says Cisco has already deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where it found evidence of a potential compromise.[1] SecurityOnline reports that the CISA Known Exploited Vulnerabilities catalogue lists the flaw as added to KEV: Oct 14, 2026[3].The Hacker News notes that this is the second Secure Email Gateway flaw Cisco has confirmed under attack in a month[2], and that Cisco has not linked the attacks.[2]