Cisco Secure Email
Monthly
Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Unauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncOS builds (13.x, 14.x, 15.x and 16.x), where crafted inbound email can inject SQL into the mail-parsing pipeline and ultimately achieve OS-level code execution. Exploitation requires no authentication, no user interaction, and no non-default configuration per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), so any internet-facing or mail-receiving appliance - the product's normal deployment role - is exposed. This is confirmed actively exploited (CISA KEV) with publicly available exploit code exists, and while EPSS is a moderate 2.16% (81st percentile), the KEV listing and total technical impact per SSVC make this a genuine top-priority issue rather than an inflated high-CVSS artifact.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Unauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncOS builds (13.x, 14.x, 15.x and 16.x), where crafted inbound email can inject SQL into the mail-parsing pipeline and ultimately achieve OS-level code execution. Exploitation requires no authentication, no user interaction, and no non-default configuration per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), so any internet-facing or mail-receiving appliance - the product's normal deployment role - is exposed. This is confirmed actively exploited (CISA KEV) with publicly available exploit code exists, and while EPSS is a moderate 2.16% (81st percentile), the KEV listing and total technical impact per SSVC make this a genuine top-priority issue rather than an inflated high-CVSS artifact.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.