CVE-2026-76519

Asyncos

95/100

confirmed exploited

CVSS9.8

EPSS1.7%

KEV (CISA + VulnCheck)EXPLOITED

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to wri

Listed in CISA KEV and VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.017 (probability of exploitation) · CVSS base 9.8 · 1 public PoC/exploit reference(s) available

Public PoC / Exploit1

Defensive review only — these references demonstrate exploitability.

githubMickysalivan/CVE-2026-76519-Proof-of-concept (★0)

References4

NVD detail Vendor advisorysec.cloudapps.cisco.com Referencecisa.gov CISA advisorycisa.gov CISA advisorycisa.gov

Mentions 3

securityaffairs.com
Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise
cybersecuritynews.com
Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
securityonline.info
Critical Cisco Secure Email Gateway Vulnerability CVE-2026-76519 Actively Exploited in the Wild