Two issues in Cisco’s Secure Email hardening release are already being exploited. The Cisco advisory, first published September 14 and updated October 14 with a related-advisory link, covers five weakness groups in Secure Email Gateway and Secure Email and Web Manager.
Cisco’s engineering team found the issues in an internal review using established testing and frontier AI models. Its advisory says, “Two of them are known to be actively exploited.” That applies to underlying findings in the path-traversal and improper-neutralization groups; Cisco PSIRT says it is unaware of malicious use of the other findings. Both products are affected regardless of device configuration. Cisco Secure Web Appliance is outside this advisory’s affected product list.
Exploitation sits inside broader groups
Cisco assigned one CVE per weakness class rather than one per underlying finding. The path-traversal group, CVE-2026-76440, includes improper limits on file paths and link resolution before file access. Cisco associates one actively exploited arbitrary-file-write finding with that group. The improper-neutralization group, CVE-2026-76443, covers command, SQL and code/eval injection as well as cross-site scripting; one SQL-injection finding in it is actively exploited. Path traversal can let a file operation escape its intended directory; improper neutralization can let input change the meaning of a SQL query or command. Cisco scores each group by its most severe underlying finding.
Two more groups reach CVSS 9.8: improper access control (CVE-2026-76441) and improper resource-lifetime control (CVE-2026-20353). Improper quantity validation (CVE-2026-76442) reaches 7.5 and includes unbounded numeric inputs that drive excessive resource use. Use the whole Cisco fixed-release table for upgrade planning rather than treating a single CVE match as the full inventory.
Different products need different builds
A vulnerable build remains affected across device configurations. Compare the running build on each gateway and manager with Cisco’s table. For Secure Email Gateway, the first fixes are 15.5.5-014 for 15.5 and earlier and 16.5.0-780 for 16.5. For Secure Email and Web Manager, they are 15.5.5-006 and 16.5.0-429 respectively. Both products on 16.0 need migration to a fixed release. Cisco says there are no workarounds, so a configuration-only change leaves the vulnerable software in place.
For a self-managed appliance, schedule the appropriate fixed build through the web interface under System Administration > System Upgrade, or use the CLI upgrade workflow. The appliance reboots after installation. Cisco maintains Secure Email Cloud appliances and says cloud customers can ask its support team for an upgrade. For exposed appliances, preserve logs and ask Cisco TAC for issue-specific investigation guidance while you upgrade.
Verify the running release
Inventory Secure Email Gateway and Secure Email and Web Manager separately. Read each self-managed appliance’s running build; request the same build information from Cisco for cloud-managed appliances. Compare each product and branch with Cisco’s fixed-release table. Install the appropriate fixed build, or request the cloud upgrade through Cisco support. Migrate either product on 16.0 to a fixed release.
For previously exposed appliances, preserve logs and ask Cisco TAC for issue-specific investigation guidance while the upgrade is scheduled. After the reboot, read the running build again and compare it with the correct product row: a gateway on 15.5 should show 15.5.5-014 or a suitable later fixed release, while a manager on that line should show 15.5.5-006 or a suitable later fixed release. Check 16.5 against its separate gateway and manager targets, 16.5.0-780 and 16.5.0-429.