Cisco has an update available to handle multiple vulnerabilities in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager with at least one undergoing active exploitation.
These vulnerabilities ended up discovered during internal testing. One of the vulnerabilities is undergoing active exploitation. These vulnerabilities affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, regardless of device configuration.
Cisco released software updates that address these vulnerabilities, according to an advisory. There are no workarounds that address these vulnerabilities.
In one issue, there is a path traversal, which covers improper limitation of a pathname to a restricted directory and improper link resolution before file access.
CVE-2026-76440 is the case number for the vulnerability, which has a CVSS base score of 9.8.
Also, there is an improper access control issue that covers authorization, authentication, privileges, and bypasses.
CVE-2026-76441 is the case number for the vulnerability, which has a CVSS base score of 9.8.
Another Vulnerability
Additionally, there is an improper control of a resource through its lifetime vulnerability, which covers uncontrolled resource consumption, algorithmic complexity, recursion/iteration, deserialization, and improper resource initialization.
CVE-2026-20353 is the case number for the vulnerability, which has a CVSS base score of 9.8.
Meanwhile, there is an improper neutralization vulnerability that covers command, SQL, and code/eval injection, and cross-site scripting.
CVE-2026-76443 is the case number for this vulnerability, which has a CVSS base score of 9.8.
Moreover, there is an improper validation of specified quantity in input vulnerability that covers unbounded numeric fields that drive excessive resource consumption.
CVE-2026-76442 is the case number for the vulnerability, which has a CVSS base score of 7.5.
To remediate these vulnerabilities and avoid future exposure, Cisco recommends users upgrade to the fixed software indicated in this advisory.
For Cisco Secure Email Gateway users with versions:
- 15.5 and earlier, that can update to 15.5.5-014
- 16.0, migrate to a fixed release
- 16.5, update to 16.5.0-780
For Cisco Secure Email and Web Manager, users with versions:
- 15.5 and earlier, they can update to 15.5.5-006
- 16.0, migrate to a fixed release
- 16.5, update to 16.5.0-429
Software can end up upgraded over the network by using the System Upgrade options in the web-based management interface of the appliance.
To upgrade a device by using the CLI, do the following:
- Run upgrade
- Enter DOWNLOADINSTALL
- Choose a release to upgrade to
- Choose the appropriate options throughout the upgrade process
Click here for other security fixes from Cisco.