Unauthenticated access flaws in Cisco Secure Email Gateway: a defender's read of CVE-2026-76440

Two of the five CVEs in Cisco's September 2026 email security release share a property that should shape how defenders prioritise them: they are reachable by unauthenticated remote attackers. CVE-2026-76440 and CVE-2026-76441 both fall into that category, which is why the release as a whole carries a CRITICAL rating.

Vulnerability overview

CERT-In published the details as note CIVN-2026-0461 on 17 September 2026. The five CVEs are CVE-2026-76440 (path traversal), CVE-2026-76441 (improper access control), CVE-2026-76442 (input validation of quantity), CVE-2026-76443 (improper neutralisation) and CVE-2026-20353 (resource lifetime control).

Mechanism and exploitation conditions

CVE-2026-76440 arises from improper validation and resolution of pathnames and symbolic links. CERT-In states that an unauthenticated, remote attacker can bypass intended directory restrictions. CVE-2026-76441 is an improper access control weakness that lets a remote, unauthenticated attacker bypass authentication or authorisation controls and gain access to restricted resources or functionality.
The remaining three are no less relevant. CVE-2026-76442 allows unbounded or excessively large numeric input. CVE-2026-76443 permits injection into security-sensitive contexts including command, SQL, code/evaluation and cross-site scripting. CVE-2026-20353 enables uncontrolled resource consumption via improper resource management, unsafe deserialization or improper resource initialisation.

Impact

For the two unauthenticated flaws, the impact is direct: sensitive files can be read or modified, and restricted functions can be reached without credentials. The other three degrade availability and, in the case of the neutralisation flaw, can enable unauthorised command or code execution.

Affected products and scope

Cisco Secure Email Gateway 15.5 and earlier and Cisco Secure Email and Web Manager 15.5 and earlier are affected. Confirm the exact build against the Cisco advisory before concluding a system is patched.

Exposure context

ZoomEye returned 1,782 instances for the fingerprint app="Cisco Secure Email Gateway". This indicates how many assets present that product identity, not how many are exploitable. The CVE-indexed query vul.cve="CVE-2026-76440" returned zero results at the time of writing.

Remediation and mitigations

Apply the fixed builds from Cisco's advisory cisco-sa-hardening-esa-dfCrfXkm. Because two flaws need no credentials, network-level restriction of the affected interfaces is a high-value interim control. Log and alert on file access outside expected directories and on sudden resource consumption.