Key points
- Cisco Secure Email Gateway and Secure Email and Web Manager are affected by multiple vulnerabilities, including two under active exploitation.
- Software updates are available to remediate these issues, but no workarounds exist to mitigate the risk without upgrading.
- The vulnerabilities affect all device configurations and include classes such as SQL injection and arbitrary file write.
Cisco has issued a critical security advisory for its Secure Email Gateway and Secure Email and Web Manager products. The vendor released software updates to address multiple vulnerabilities discovered during internal testing, with two of these flaws confirmed to be under active exploitation.
What happened
The Cisco product security incident response team conducted a comprehensive internal review of the Secure Email Gateway and Secure Email and Web Manager platforms. This assessment identified multiple vulnerabilities across several categories, including path traversal, improper access control, and improper neutralisation of inputs.
Cisco grouped these issues by their underlying Common Weakness Enumeration class and assigned a single Common Vulnerabilities and Exposures identifier to each grouping. The advisory lists five CVE IDs, including CVE-2026-20353 and CVE-2026-76440, which cover the maximum potential severity of the most impactful underlying vulnerability within each category.
Two of the vulnerabilities are known to be actively exploited. The advisory specifically references a SQL injection vulnerability and an arbitrary file write vulnerability as the subjects of active abuse. These flaws affect the products regardless of the specific device configuration, meaning all installations are potentially at risk.
Why it matters
Organisations relying on Cisco Secure Email Gateway or Secure Email and Web Manager must act quickly to prevent potential compromise. The active exploitation of these flaws indicates that threat actors are already attempting to leverage them against unpatched systems in the wild.
The absence of workarounds means that organisations cannot mitigate the risk through configuration changes or temporary network restrictions. The only effective remediation is to upgrade to the fixed software releases provided by Cisco. Failure to update leaves systems exposed to the identified vulnerability classes.
Cisco has confirmed that the Cisco Secure Web Appliance is not affected by these specific vulnerabilities. However, teams managing email gateways must verify their software versions against the fixed releases listed in the advisory to ensure they are protected.
What happens next
- Download the fixed software releases from the Cisco support portal.
- Verify the current software version of your Secure Email Gateway and Manager appliances.
- Schedule maintenance windows to apply the updates via the web-based management interface.
- Monitor system logs for any signs of exploitation attempts following the update process.
Patch priority
Security operations teams should prioritise updating systems that are directly exposed to the internet or handle sensitive email traffic. Before applying the updates, ensure that configuration backups are current and that the upgrade process is tested in a non-production environment if possible. Coordinate with stakeholders to minimise service disruption during the maintenance window. Monitor for any anomalies post-upgrade to confirm stability.
What to do and how to stay safe: Cisco
- Inventory all instances of Cisco Secure Email Gateway and Secure Email and Web Manager to identify vulnerable versions.
- Review the Cisco security advisory to determine the specific fixed software release required for your current version.
- Prepare to upgrade the appliances using the System Upgrade options in the web-based management interface.
- Monitor for any unusual activity or exploitation attempts while planning the update rollout.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are there any workarounds for these vulnerabilities?
No, Cisco has stated that there are no workarounds available to address these vulnerabilities; upgrading to the fixed software is required.
Which Cisco products are affected by this advisory?
The advisory affects Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, regardless of device configuration.
Is the Cisco Secure Web Appliance affected?
No, Cisco has confirmed that these vulnerabilities do not affect the Cisco Secure Web Appliance.
