What is the CVSS score of EUVD-2026-77620?

EUVD-2026-77620 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Cisco Secure Email are affected by EUVD-2026-77620?

Cisco Secure Email and Web Manager is affected by an improper access control flaw in its management/administrative interface across builds 12.8.1-002 through 16.0.4-010, with the independent CVSS…

How to fix or mitigate EUVD-2026-77620?

No vendor-released patch identified at time of analysis; within 24 hours, inventory all Cisco Secure Email and Web Manager instances and confirm whether any run affected builds 12.8.1-002 through 16.0.4-010, then restrict management/admin interface access to trusted management networks or VPN, enforce MFA, disable unnecessary remote management, review administrative logs for anomalous access, and validate that no unauthorized accounts or policy changes exist. Within 7 days, continue monitoring Cisco's advisory for a vendor-released patch, enforce least privilege for administrative accounts, rotate credentials, segment the management plane, enable enhanced logging and alerting, and apply any vendor-provided workarounds or configuration hardening. Within 30 days, deploy the vendor patch once released and validate remediation across every affected build, re-scan to confirm closure, and only then relax temporary controls; if no vendor-released patch is available, maintain compensating controls and reassess risk against updated threat intelligence, EPSS, and CISA KEV status.

Cisco Secure Email EUVD-2026-77620

| CVE-2026-76441 CRITICAL

Improper Access Control (CWE-284)

2026-09-14 cisco

GHSA-pg5v-5c7m-xq99

Authentication Bypass Cisco Cisco Secure Email And Web Manager

9.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Access-control flaws on an admin appliance usually require some session/foothold (PR:L) and typically enable unauthorized read/access more than full integrity/availability compromise, so C:H/I:L/A:N pending vendor detail.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 11:29 vuln.today

CVE Published

Sep 14, 2026 - 16:08 cve.org

CRITICAL 9.8

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76441 are related to issues with improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

AnalysisAI

Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must be able to reach the management/administrative interface of a Cisco Secure Email and Web Manager appliance running an affected build (per EUVD, builds across 12.8.1 through 16.0.4). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The headline CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this as critical, but the surrounding signals argue for tempering that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor hardening updates are referenced in Cisco's advisory, so apply the fixed build that Cisco assigns to your Secure Email and Web Manager train; the provided data does not give exact fixed version numbers, so consult https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm to map each affected release to its patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

No vendor-released patch identified at time of analysis; within 24 hours, inventory all Cisco Secure Email and Web Manager instances and confirm whether any run affected builds 12.8.1-002 through 16.0.4-010, then restrict management/admin interface access to trusted management networks or VPN, enforce MFA, disable unnecessary remote management, review administrative logs for anomalous access, and validate that no unauthorized accounts or policy changes exist. …

Threat intelligence, references, and detailed analysis are available after sign-in.