CVE-2026-76519 Splunk · SPL

Detect Cisco Secure Email Gateway Relative Path Traversal (CVE-2026-76519) in Splunk

Detects exploitation of CVE-2026-76519, a relative path traversal (CWE-23) vulnerability in the Cisco Secure Email Gateway (ESA) Advanced File Analysis / web management framework. An attacker can craft HTTP requests containing relative path traversal sequences (e.g. ../, ..%2f, ..%5c) against the ESA management or quarantine web interface to read or write files outside the intended directory, potentially leading to disclosure of configuration/credential files or file write. This CVE is listed in CISA KEV (actively exploited) and is in scope for BOD 26-04 risk-based patching prioritization. Detection focuses on traversal patterns in URIs/headers directed at ESA web listeners, anomalous file access by the ESA web service account, and outbound responses returning sensitive file content.

MITRE ATT&CK

Tactic
Initial Access Collection

SPL Detection Query

Splunk (SPL)
spl 
index=cisco_esa (sourcetype=cisco:esa:http OR sourcetype=cisco:esa:gui OR sourcetype=cisco:esa:textmail)
| eval uri=lower(coalesce(url, uri_path, request))
| where match(uri, "(\.\./|\.\.%2f|\.\.%252f|\.\.%5c|%2e%2e%2f|\.\.\\\\|\.\.\.\./)")
| where match(uri, "(etc/|passwd|shadow|config|certificate|private|quarantine|euq|\.xml)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip dest_ip dest_host
| where count > 0
high severity medium confidence

Searches Cisco ESA web/GUI access logs for path-traversal sequences targeting sensitive file paths, surfacing CVE-2026-76519 exploitation.

Data Sources

Cisco Secure Email Gateway HTTP/GUI access logs forwarded to Splunk

Required Sourcetypes

cisco:esa:httpcisco:esa:guicisco:esa:textmail

False Positives & Tuning

  • Authorized vulnerability scans generating traversal probes
  • Penetration testing engagements against the ESA appliance
  • Benign requests where '..' appears inside an encoded legitimate parameter

Other platforms for CVE-2026-76519

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Basic path traversal to /etc/passwd against ESA GUI

    Expected signal: ESA HTTP/GUI access log entry showing the traversal URI and the response status code/size.

  2. Test 2 Double-encoded traversal to configuration file

    Expected signal: ESA access log records the double-encoded path and response.

  3. Test 3 Backslash traversal variant against quarantine endpoint

    Expected signal: ESA web log entry containing the backslash-encoded traversal sequence.

Last updated: 2026-10-15 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the targeted host is a Cisco Secure Email Gateway and identify its software version; compare against Cisco advisory cisco-sa-esa-afw-zqYJkjxp to determine if it is unpatched.
  2. Decode the full request URI/headers and determine which file path the traversal attempted to reach (e.g. configuration, certificate, quarantine, /etc/ files).
  3. Determine whether the request succeeded — check the HTTP response code/size; a 200 with a large body suggests successful file disclosure versus a 403/404 block.
  4. Identify the source IP, geolocation, and whether it is an authenticated session or unauthenticated access to the management plane.

Containment

  1. Apply the Cisco fixed release per advisory cisco-sa-esa-afw-zqYJkjxp, or restrict access to the ESA management/quarantine web interface to trusted management networks only.
  2. Block the offending source IP(s) at the perimeter firewall/WAF and disable any compromised administrative sessions.
  3. If file disclosure is confirmed, rotate any credentials, API keys, or certificates that may have been exposed from the appliance configuration.

Evidence Collection

  1. Export the ESA GUI/HTTP access logs and mail logs covering the activity window and preserve them with hashes.
  2. Capture the raw matching HTTP requests and responses (full URI, headers, body size, status code) for IR records.
  3. Collect the ESA configuration backup and running config to assess what files were reachable and whether any were modified.

Escalation Criteria

  • !Escalate to IR lead if a traversal request returned HTTP 200 with content from a sensitive path (confirmed disclosure).
  • !Escalate if evidence shows file write or configuration modification, or if exposed credentials/certificates are confirmed in use elsewhere.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >ESA GUI/HTTP access log entries containing traversal sequences
  • >HTTP response size/status indicating successful file read
  • >Appliance configuration backup showing unauthorized changes or accessed file timestamps

Tuning Guidance

Baseline and exclude authorized vulnerability scanner source IPs. Tighten the sensitive-file keyword list to your appliance's real paths to reduce noise, and raise severity when the HTTP response indicates a successful (200) read of a sensitive file. If the management interface is not internet-exposed, restrict the rule scope to internal source ranges to further cut false positives.

Hunting Queries

Surfaces source IPs issuing a high volume of requests containing '..' to the ESA, a signal of automated traversal scanning.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceProduct has_any ("Email Security","ESA","Secure Email") | extend uri=tolower(RequestURL) | where uri contains ".." | summarize count() by SourceIP, bin(TimeGenerated, 1h) | where count_ > 10
Hunting — SPL
spl 
index=cisco_esa | eval uri=lower(url) | where like(uri,"%..%") | stats count by src_ip | where count > 10

Atomic Red Team Tests

Test 1 Basic path traversal to /etc/passwd against ESA GUI
linux

Sends an unauthenticated HTTP request with encoded traversal sequences attempting to read /etc/passwd from the ESA web interface.

Command

bash 
curl -sk 'https://esa-lab.local:443/euq/..%2f..%2f..%2f..%2fetc%2fpasswd' -H 'User-Agent: atomic-cve-2026-76519'

Cleanup

bash 
echo 'No cleanup required; read-only request'

Expected Telemetry

ESA HTTP/GUI access log entry showing the traversal URI and the response status code/size.

Expected Detection

KQL/SPL rules match on '..%2f' + 'passwd' in the request URI to the ESA.

Test 2 Double-encoded traversal to configuration file
linux

Attempts a double-URL-encoded traversal to reach an appliance configuration/certificate file.

Command

bash 
curl -sk 'https://esa-lab.local:443/mail_policy/..%252f..%252f..%252fdata%252fconfig%252fconfig.xml' -H 'User-Agent: atomic-cve-2026-76519'

Cleanup

bash 
echo 'No cleanup required'

Expected Telemetry

ESA access log records the double-encoded path and response.

Expected Detection

Detection matches '..%252f' combined with 'config'/'.xml' keywords.

Test 3 Backslash traversal variant against quarantine endpoint
windows

Uses backslash-encoded traversal targeting the spam quarantine (EUQ) endpoint to test alternate separator handling.

Command

powershell 
powershell -Command "Invoke-WebRequest -Uri 'https://esa-lab.local/euq/..%5c..%5c..%5cetc%5cpasswd' -SkipCertificateCheck -UserAgent 'atomic-cve-2026-76519'"

Cleanup

powershell 
Write-Host 'No cleanup required'

Expected Telemetry

ESA web log entry containing the backslash-encoded traversal sequence.

Expected Detection

Rules match '..%5c' + sensitive-path keyword against the ESA.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0009 Collection

Related Techniques

T1190 Exploit Public-Facing Application T1083 File and Directory Discovery

Same Tactic: Initial Access

Popular Detections