Cisco Secure Email Gateway - AMP Path Traversal System File Write
Detects the Cisco AsyncOS content scanner / AMP service writing files into sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative path traversal in AMP attachment handling so a crafted email makes the root-running scanner write attacker-chosen files wherever it likes. Writes outside the expected spool and Content Scanner Tools directories are the core exploitation artifact.
YARA-L
