Cisco Secure Email And Web Manager
Monthly
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. Affected builds span the EUVD-listed 12.8.1-002 through 16.0.4-010 trains; no public exploit has been identified at time of analysis, EPSS is 0.46% (39th percentile), and CISA SSVC records exploitation as none.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. Affected builds span the EUVD-listed 12.8.1-002 through 16.0.4-010 trains; no public exploit has been identified at time of analysis, EPSS is 0.46% (39th percentile), and CISA SSVC records exploitation as none.