Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519) is being actively exploited, CISA warns
CISA added CVE-2026-76519 (Cisco Secure Email Gateway) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Enterprises
Affected technology: Cisco networking & security, Secure Email Gateway
Why it matters
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Secure Email Gateway systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running Cisco networking & security and Secure Email Gateway, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2026-76519: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by October 17, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134) is being actively exploited, CISA warns
CISA added CVE-2026-105134 (Ahsay AhsayCBS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s…
CISA lists this as exploited in the wild. Unpatched AhsayCBS and PAN-OS / GlobalProtect systems are exposed to active attacks now.
Treat this as an emergency.
Cisco Patches a Dozen Critical Vulnerabilities
The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.
Apply the vendor's security update for Cisco networking & security.
Cisco warns of critical flaws allowing Nexus switch takeover
Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches.