From path traversal to denial of service: the full CVE set behind Cisco's email gateway patch

A single patch cycle can close very different classes of weakness at once. Cisco's September 2026 email security update is a clear example: the five CVEs it addresses range from a file-access escape to resource exhaustion, and CERT-In has grouped them under one CRITICAL note.

Vulnerability overview

The note is CIVN-2026-0461, issued 17 September 2026. It covers CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443 and CVE-2026-20353. Cisco's advisory cisco-sa-hardening-esa-dfCrfXkm carries the vendor fix guidance.

Mechanism and exploitation conditions

CVE-2026-76440 is a path traversal resulting from improper validation and resolution of pathnames and symbolic links; an unauthenticated remote attacker can bypass directory restrictions. CVE-2026-76441 is an improper access control flaw allowing a remote, unauthenticated attacker to bypass authentication or authorisation controls. CVE-2026-76442 concerns input validation of quantity, permitting unbounded or excessively large numeric input. CVE-2026-76443 is an improper neutralisation issue spanning command, SQL, code/evaluation and cross-site scripting contexts. CVE-2026-20353 is a resource lifetime control weakness reached through improper resource management, unsafe deserialization or improper resource initialisation.

Impact

The path traversal and access control flaws can expose or alter sensitive files and restricted functionality. The quantity and resource lifetime flaws can cause excessive resource consumption, service degradation and denial-of-service. The neutralisation flaw can lead to unauthorised command or code execution and data manipulation within the affected component.

Affected products and scope

Cisco Secure Email Gateway 15.5 and earlier and Cisco Secure Email and Web Manager 15.5 and earlier are listed. Administrators should verify their build against the Cisco advisory rather than relying on a version label alone.

Exposure context

A ZoomEye search for app="Cisco Secure Email Gateway" returned 1,782 instances globally. This count describes product-fingerprint matches and does not establish that any host is vulnerable. The CVE-indexed query vul.cve="CVE-2026-76440" returned zero, which is typical immediately after publication.

Remediation and mitigations

Move to the fixed release named by Cisco. CERT-In directs readers to cisco-sa-hardening-esa-dfCrfXkm. Until the upgrade is complete, constrain network access to the affected services and monitor for file access outside expected paths and for abnormal resource use.