A relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway (SEG), caused by improper handling of email attachments, letting remote unauthenticated attackers execute commands with root privileges. Cisco released security updates and confirmed exploitation in the wild; CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalogue on 14 October 2026. SEG is a common email-perimeter appliance for government and enterprise estates, so patching immediately and reviewing SEG logs for prior compromise is the operative response.