How severe is CVE-2026-76519?

CVE-2026-76519 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-76519 being actively exploited?

Yes. CVE-2026-76519 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-10-14, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2026-76519?

CVE-2026-76519 affects Cisco Asyncos. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-76519?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

When was CVE-2026-76519 published?

CVE-2026-76519 was published on 2026-10-14 and last updated on 2026-10-15.

CVE-2026-76519

CVE-2026-76519 is a critical-severity vulnerability in Cisco Asyncos with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2026-10-14). The underlying weakness is classified as CWE-23.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2026-10-14)
Weakness: CWE-23
Affected product: Cisco Asyncos
Published: 2026-10-14
Last modified: 2026-10-15

Description

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

Frequently asked questions

What is CVE-2026-76519?: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
How severe is CVE-2026-76519?: CVE-2026-76519 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-76519 being actively exploited?: Yes. CVE-2026-76519 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-10-14, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2026-76519?: CVE-2026-76519 affects Cisco Asyncos. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-76519?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
When was CVE-2026-76519 published?: CVE-2026-76519 was published on 2026-10-14 and last updated on 2026-10-15.

References

Affected products (1)

cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Asyncos

CVE-2025-20393 — Critical (CVSS 10.0): A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco…
CVE-2026-76461 — Critical (CVSS 9.8): A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an…
CVE-2024-20435 — High (CVSS 8.8): A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to…
CVE-2019-15956 — High (CVSS 8.8): A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could…
CVE-2021-34698 — High (CVSS 8.6): A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an…
CVE-2019-1947 — High (CVSS 8.6): A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance…

All CVEs affecting Cisco Asyncos →

Other CWE-23 vulnerabilities

CVE-2026-52813 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences…
CVE-2026-8326 — Critical (CVSS 10.0): Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing…
CVE-2026-33494 — Critical (CVSS 10.0): ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based…
CVE-2023-3941 — Critical (CVSS 10.0): Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system…
CVE-2024-24578 — Critical (CVSS 10.0): RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior…
CVE-2012-6069 — Critical (CVSS 10.0): The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an…

Browse all CWE-23 vulnerabilities →