EUVD-2026-77622
GHSA-rx6x-7px9-ppg5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Path traversal on an appliance web interface is read-oriented (C:H, minor I:L, no A); management access likely needs a session, so PR:L rather than PR:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76440 are related to path traversal issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-23.
AnalysisAI
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the Cisco Secure Email Gateway (ESA) or Secure Email and Web Manager (SMA) HTTP/management interface running an affected build (12.8.x through 16.x per the EUVD list). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are internally consistent but point to a lower real-world priority than the 9.8 headline suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: Cisco states that this internal security review produced software hardening releases that address CVE-2026-76440, so the primary action is to upgrade ESA and SMA appliances to the fixed builds specified in Cisco advisory cisco-sa-hardening-esa-dfCrfXkm (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm); the provided data does not enumerate exact patched version strings, so confirm the target build against that advisory rather than assuming any build at or above the listed affected versions is fixed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco Secure Email Gateway (ESA) builds 13.0.5-007, 14.x, 15.0.x, 15.5.x, and 16.0.x and Cisco Secure Email and Web Manager (SMA) builds 12.8.1, 13.x, 14.x, 15.x, and 16.x, restrict management interface access to trusted administrative networks, enforce MFA and least privilege, and review authentication and file-access logs for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Secure Email
View allUnauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncO
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment c
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internall
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity v
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of messa
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today