/
← Voltar ao feed
critical

Cisco releases hardening fixes for Secure Email Gateway and Web Manager; two internally found flaws actively exploited

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 13:00 · coletado há 1 dia

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco published a security hardening release for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager (September 2026), fixing multiple vulnerabilities found during an internal security review. Cisco states that two of them are known to be actively exploited. They are described in separate advisories as a SQL injection and an arbitrary file write vulnerability in Secure Email Gateway. Cisco grouped the issues by CWE class and assigned one CVE ID to each grouping. The advisory carries a Security Impact Rating of Critical, and Cisco states that no workarounds exist.

Technical Details

  • CVEs listed: CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443.
  • The two actively exploited issues are a SQL injection and an arbitrary file write in Secure Email Gateway. The article does not say which CVEs they map to.
  • The article gives no IOCs, threat actor attribution, affected version ranges or exploitation details.

Remediation

  • Apply the software updates Cisco released for Secure Email Gateway and Secure Email and Web Manager. No workarounds are available.
  • Prioritize patching of the exposed Secure Email Gateway appliances because of the confirmed exploitation.
  • See the Cisco advisory cisco-sa-hardening-esa-dfCrfXkm for the fixed releases.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 14/10/2026 13:00 · coletado 19/10 18:01 primeiro registro só resumo do feed

    Cisco releases hardening fixes for Secure Email Gateway and Web Manager; two internally found flaws actively exploited

    ler a análise desta fonte

    Cisco published a security hardening release for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager (September 2026), fixing multiple vulnerabilities found during an internal security review. Cisco states that two of them are known to be actively exploited. They are described in separate advisories as a SQL injection and an arbitrary file write vulnerability in Secure Email Gateway. Cisco grouped the issues by CWE class and assigned one CVE ID to each grouping. The advisory carries a Security Impact Rating of Critical, and Cisco states that no workarounds exist.

    Technical Details

    • CVEs listed: CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443.
    • The two actively exploited issues are a SQL injection and an arbitrary file write in Secure Email Gateway. The article does not say which CVEs they map to.
    • The article gives no IOCs, threat actor attribution, affected version ranges or exploitation details.

    Remediation

    • Apply the software updates Cisco released for Secure Email Gateway and Secure Email and Web Manager. No workarounds are available.
    • Prioritize patching of the exposed Secure Email Gateway appliances because of the confirmed exploitation.
    • See the Cisco advisory cisco-sa-hardening-esa-dfCrfXkm for the fixed releases.