Cisco Secure Email Gateway Relative Path Traversal (CVE-2026-76519)

let traversalPatterns = dynamic(["../","..%2f","..%252f","..%5c","..\\","%2e%2e%2f","%2e%2e/","....//"]);
CommonSecurityLog
| where DeviceVendor == "Cisco"
| where DeviceProduct has_any ("Email Security", "ESA", "Secure Email")
| extend uri = tolower(coalesce(RequestURL, AdditionalExtensions))
| where uri has_any (traversalPatterns)
| where uri has_any ("/etc/", "passwd", "shadow", "config", ".xml", "certificate", "private", "quarantine", "euq")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod=DeviceCustomString1, uri, DeviceName
| sort by TimeGenerated desc

index=cisco_esa (sourcetype=cisco:esa:http OR sourcetype=cisco:esa:gui OR sourcetype=cisco:esa:textmail)
| eval uri=lower(coalesce(url, uri_path, request))
| where match(uri, "(\.\./|\.\.%2f|\.\.%252f|\.\.%5c|%2e%2e%2f|\.\.\\\\|\.\.\.\./)")
| where match(uri, "(etc/|passwd|shadow|config|certificate|private|quarantine|euq|\.xml)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip dest_ip dest_host
| where count > 0

network where event.category == "network" and
  (destination.port in (443, 80, 8443)) and
  cisco.esa.product == "Secure Email Gateway" and
  (
    stringContains(url.original, "../") or
    stringContains(url.original, "..%2f") or
    stringContains(url.original, "..%5c") or
    stringContains(url.original, "%2e%2e%2f")
  ) and
  (
    stringContains(url.path, "etc") or
    stringContains(url.path, "passwd") or
    stringContains(url.path, "config") or
    stringContains(url.path, "quarantine")
  )

SELECT sourceip, destinationip, destinationport, "URL" AS uri, "deviceTime" FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Cisco%Email%' AND (LOWER("URL") LIKE '%../%' OR LOWER("URL") LIKE '%..%2f%' OR LOWER("URL") LIKE '%..%5c%' OR LOWER("URL") LIKE '%%2e%2e%2f%') AND (LOWER("URL") LIKE '%etc/%' OR LOWER("URL") LIKE '%passwd%' OR LOWER("URL") LIKE '%config%' OR LOWER("URL") LIKE '%quarantine%') ORDER BY "deviceTime" DESC LAST 24 HOURS

_sourceCategory=cisco/esa
| lowercase(_raw) as raw
| where raw matches /(\.\.\/|\.\.%2f|\.\.%5c|%2e%2e%2f)/
| where raw matches /(etc\/|passwd|shadow|config|quarantine|euq|certificate)/
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| count by src_ip, _sourceHost
| sort by _count

rule cisco_esa_cve_2026_76519_path_traversal {
  meta:
    author = "Argus"
    description = "Cisco Secure Email Gateway relative path traversal CVE-2026-76519"
    severity = "HIGH"
    cve = "CVE-2026-76519"
  events:
    $e.metadata.vendor_name = "Cisco"
    $e.target.application = /Secure Email|ESA|Email Security/ nocase
    re.regex($e.network.http.referral_url, `(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f)`) nocase
    $e.target.url = /(etc/|passwd|shadow|config|quarantine|certificate)/ nocase
  condition:
    $e
}

#event_simpleName=/Http/ 
| product=/Secure Email|ESA/i
| lower(url) as uri
| uri=/(\.\.\/|\.\.%2f|\.\.%5c|%2e%2e%2f)/
| uri=/(etc\/|passwd|shadow|config|quarantine|certificate)/
| groupBy([src_ip, dest_host], function=count())