Two Actively Exploited Flaws Hit Cisco Email Gateway; Updates Available Now

Cisco has issued a critical security advisory for its Secure Email Gateway and Secure Email and Web Manager products, revealing that two vulnerabilities are currently being exploited in the wild. The vendor released software updates in September 2026 to address these issues, which were discovered during internal security testing. Because no workarounds exist, organizations relying on these appliances must apply the patches immediately to close the exposure.

What exactly is vulnerable?

The advisory covers multiple internally discovered flaws grouped by their underlying vulnerability class, including SQL injection, arbitrary file write, path traversal, and improper access control. Cisco assigned a single CVE ID to each Common Weakness Enumeration (CWE) grouping to streamline the disclosure process. The affected products are the Cisco Secure Email Gateway and the Secure Email and Web Manager. Cisco confirmed that the Secure Web Appliance is not affected by these specific vulnerabilities.

Why is the severity rated as critical?

Cisco rates the security impact as critical primarily because two of the vulnerabilities are known to be actively exploited. The advisory lists five CVE IDs: CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, and CVE-2026-76443. Each CVE represents the maximum potential severity of the most impactful underlying vulnerability within its specific CWE category. The active exploitation status elevates the urgency for defenders to remediate these systems without delay.

Does configuration matter for exposure?

According to the advisory, these vulnerabilities affect the Cisco Secure Email Gateway and Secure Email and Web Manager regardless of device configuration. This means that even if an organization has hardened its settings or restricted access, the underlying code flaws remain present and exploitable. Only the specific software releases listed in the vulnerable products section are at risk. Customers must verify their current version against the fixed software table provided by Cisco.

How should teams respond?

Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisory to remediate the vulnerabilities and avoid future exposure. The software can be upgraded over the network using the System Upgrade options in the web-based management interface of the appliance. Users should navigate to System Administration and then System Upgrade to initiate the process. Since there are no workarounds, delaying the update leaves the environment exposed to the known active exploits.

Detection notes

Security teams should monitor logs for unusual database query patterns or unexpected file writes on the gateway servers, which may indicate exploitation of SQL injection or arbitrary file write flaws. Check for any new administrative accounts or modified system files that do not match known change management records. Look for outbound connections to unfamiliar IP addresses from the appliance, as compromised systems often beacon to command and control servers. If suspicious activity is detected, isolate the affected device from the network immediately to prevent lateral movement while preparing for the software upgrade.

Background: Lateral movement

Stop lateral movement by enforcing least privilege, segmenting networks, and monitoring internal traffic. This checklist provides specific controls to limit an attacker’s ability to move between systems after gaining initial access.

Read the full guide: Lateral Movement Prevention Checklist for Network Security

What to do and how to stay safe: Cisco

• Verify the current software version of your Cisco Secure Email Gateway and Secure Email and Web Manager against the vulnerable releases listed in the advisory.
• Schedule an immediate maintenance window to apply the latest software update via the web-based management interface, as no workarounds are available.
• Monitor network traffic and system logs for signs of unauthorized access or unusual behavior that could indicate successful exploitation of the known flaws.
• Confirm that your Cisco Secure Web Appliance is not affected, as the advisory states these vulnerabilities do not impact that product line.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are there any workarounds for these vulnerabilities?

No, Cisco has stated that there are no workarounds that address these vulnerabilities; customers must upgrade to the fixed software releases.

Which Cisco products are affected by this advisory?

The Cisco Secure Email Gateway and Cisco Secure Email and Web Manager are affected, regardless of device configuration.

Is the Cisco Secure Web Appliance vulnerable?

No, Cisco has confirmed that these vulnerabilities do not affect the Cisco Secure Web Appliance.