Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2026-76519

ciscosecure email gateway virtual appliance c100v

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

VTP deterministic threat38.8of 100 · CVSS excluded

VTP analyst assessment

Cisco Secure Email Gateway arbitrary file write

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence80%
Public exploitation · VTP factKEV

Assessment

CISA KEV lists this Cisco Secure Email Gateway flaw as exploited. A crafted email attachment can trigger arbitrary file writes when file reputation is enabled. Press reports say attackers can then execute commands as root.

Why it matters

  • The gateway processes inbound email, making malicious attachments the stated attack path.
  • Successful exploitation could give an attacker control of the appliance operating system.

Evidence

3 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The cited press reports exploitation, but the supplied reporting does not describe affected organizations or campaign scope.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use affected Cisco Secure Email Gateway virtual appliances, apply Cisco's remediation and restrict administrative access.

AI baseline history (5)
  1. BASELINE ASSESSED
    Cisco Secure Email Gateway arbitrary file writegpt-5.6-terra · low
  2. BASELINE ASSESSED
    Cisco Secure Email Gateway crafted-attachment attacksgpt-5.6-terra · low
  3. BASELINE ASSESSED
    Cisco Secure Email Gateway AMP attachment path traversalgpt-5.6-terra · low
  4. BASELINE ASSESSED
    Cisco Secure Email Gateway file write is actively exploitedgpt-5.6-terra · low
  5. BASELINE ASSESSED
    Cisco Secure Email Gateway zero-day reportedly exploited through crafted attachmentsgpt-5.6-terra · low
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityTECHNICAL DETAILSReliability not implied
EPSS0.0275th percentile · prediction
Evidence confidence64%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    EPSS is 0.02; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

VENDOR ADVISORYNew vendor advisory
KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

5publications detected
5underlying evidence chains

1 primary sources · 0 dependent secondary reports · 4 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOITATION REPORTEDPUBLICATION REPORTS EXPLOITATION
60%claim confidence
UNKNOWNreport:1ca39dc2c35e56516f4fd7c10ffddb6fef1951206bf0d3dfe4cd9e74881430b2ACTIVE
Evidence
Source claimEXPLOITATION REPORTEDPUBLICATION REPORTS EXPLOITATION
60%claim confidence
UNKNOWNreport:a415273d6a75e762901eb36d935fc092ada10d0855aea189c13f958af76836d6ACTIVE
Evidence
Source claimZERO DAYPUBLICATION REPORTS ZERO DAY
64%claim confidence
UNKNOWNreport:a415273d6a75e762901eb36d935fc092ada10d0855aea189c13f958af76836d6ACTIVE
Evidence
04

Event history

Threat timeline

  1. 06:3415 Oct
    EXPLOITATION REPORTED

    Exploitation Reported

    SecurityWeek supplied a deterministically extracted signal; review the linked evidence before escalation.

  2. 17:2914 Oct
    EXPLOITATION REPORTED

    Exploitation Reported

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

  3. 17:2914 Oct
    ZERO DAY

    Zero Day

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

  4. 16:0014 Oct
    VENDOR ADVISORY

    New vendor advisory

    Cisco Product Security Incident Response Team published evidence linked to CVE-2026-76519.

  5. 00:0014 Oct
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an

CVE-2026-0322CVE-2026-76519
Separate evidence group
Original
SecurityWeekPRESSUNKNOWN

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges. The post Cisco Warns of Exploited Secure Email Gateway Vulnerability appeared first on SecurityWeek .

CVE-2026-76440CVE-2026-76461CVE-2026-76519
Separate evidence group
Original
The Hacker NewsPRESSUNKNOWN

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,

CVE-2025-20393CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443CVE-2026-76461CVE-2026-76519
Separate evidence group
Original
BleepingComputerPRESSUNKNOWN

Cisco patches new Secure Email Gateway zero-day exploited in attacks

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]

CVE-2024-20401CVE-2025-20393CVE-2026-76461CVE-2026-76519
Separate evidence group
Original
Cisco Product Security Incident Response TeamVENDORINDEPENDENT

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with  root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp For further documentation of improvements and fixes in Cisco Secure Email Gateway, see Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 . <br/>Security Impact Rating: Critical <br/>CVE: CVE-2026-76519

CVE-2026-76519
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score38.8vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction0.31 / 20
Exploit availability2.5 / 15
Source independence0 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-23
CPE records
7
Deterministic history records
13
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.