CVE-2026-20353Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-664

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 4d ago at 3 mentions (2026-09-14); latest day: 1
9 total mentions across 5 days

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Disclosure

444.4%

Patch

333.3%

Active Exploitation

222.2%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	3	Active Exploitation1Disclosure1Patch1
2026-09-15	3	Disclosure1Patch2
2026-09-16	1	Disclosure1
2026-09-18	1	Disclosure1
2026-10-15	1	Active Exploitation1

Full discourse9 posts

にゃん☆たく/takumi.a@taku888infinity46d
Active Exploitation
・CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX 『（直訳）Cisco Secure Email Gateway 用の Cisco AsyncOS ソフトウェアのメール解析機能に脆弱性があり、認証されていないリモート攻撃者が、基盤となるオペレーティングシステム上でルート権限で任意のコマンドを実行できる可能性』 →KEV追加・CVE-2026-20353/CVE-2026-76440/CVE-2026-76441/CVE-2026-76442/CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm 『（直訳）これらの脆弱性は、社内テスト中に発見されました。そのうちの1つは、実際に悪用されていることが確認されています。』
Post summary
The text reports that CVE-2026-76461 (SQL Injection → RCE root) was added to CISA KEV and confirms at least one of five related CVEs is actively exploited in the wild.
210521.9K
12.0K followersView on X
Rıdvan Yağlı@ridvanyagli46d
Patch
🚨 Cisco Secure Email Gateway'de 2 yeni güvenlik açığı! Cisco Secure Email Gateway ve Secure Email and Web Manager ürünlerinde CVE-2026-76461 ve CVE-2026-20353 numaralı güvenlik açıkları yayınlandı. 🔴 CVE-2026-76461 — CVSS 9.8 AsyncOS'taki kritik SQL Injection (CWE-89) açığı, kimlik doğrulaması gerektirmeden uzaktan istismar edilebiliyor. Özel hazırlanmış e-postalar üzerinden gerçekleştirilebilecek başarılı bir saldırının root yetkileriyle keyfi komut çalıştırılmasına yol açabileceği belirtiliyor. 🟠 CVE-2026-20353 CWE-664 kapsamında sınıflandırılan açık, kaynakların yaşam döngüsü boyunca uygun şekilde kontrol edilmemesiyle ilişkili. Kaynak tükenmesi ve bunun sonucunda servis kesintisi/DoS riski oluşturabileceği belirtiliyor. Cisco Secure Email Gateway kullanan sistem yöneticilerinin ilgili güvenlik güncellemelerini takip ederek uygulaması gerekiyor.
Post summary
The post announces two Cisco Secure Email Gateway-related CVEs and provides technical vulnerability details, including SQL injection leading to potential root-level command execution and resource exhaustion leading to DoS. Its primary actionable takeaway is that administrators should apply the relevant security updates.
00060512
2.5K followersView on X
Autumn Good@autumn_good_3545d
Patch
🚨🚨🚨 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Post summary
The post lists several Cisco CVEs and points to a Cisco Security Advisory titled 'Security Hardening Release: September 2026.' It does not mention PoC code, exploit tools, active exploitation, or detailed vulnerability mechanics.
00031483
7.3K followersView on X
NCIIPC India@NCIIPC45d
Patch
#Cisco has released software updates to address #Critical vulnerabilities in Secure Email Gateway and Secure Email and Web Manager. Apply Updates! #CVE-2026-76440 #CVE-2026-76441 #CVE-2026-20353 #CVE-2026-76443 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-hardening-esa-dfCrfXkm.html
Post summary
The text announces Cisco's release of software updates addressing critical vulnerabilities in Secure Email products, with a direct call to apply patches via a linked advisory.
00020340
8.5K followersView on X
Autumn Good@autumn_good_3515d
Active Exploitation
🚨🚨🚨 『Two of them are known to be actively exploited.』 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Post summary
The post highlights multiple Cisco CVEs, explicitly states two are actively exploited in the wild, and links to a Cisco security hardening release advisory as remediation.
10000465
7.3K followersView on X
zoomeyebot@zoomeyebot42d
Disclosure
🚨 CVE-2026-20353: Cisco Secure Email Gateway Resource Lifetime Flaw Enables Denial of Service Critical Vulnerability Alert! Cisco Secure Email Gateway and Secure Email and Web Manager is affected by CVE-2026-20353. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco Secure Email Gateway" Exposure: 1.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBTZWN1cmUgRW1haWwgR2F0ZXdheSI%3D #CVE #Cisco #EmailSecurity #DoS #ZoomEye
Post summary
The text discloses CVE-2026-20353 as a resource lifetime flaw in Cisco Secure Email Gateway enabling DoS, with ~1.8k exposed instances identifiable via ZoomEye, but provides no PoC, exploit tool, active exploitation evidence, or remediation guidance.
0001051
23 followersView on X
Cybersecurity News DE@cybsecuritynews44d
Disclosure
#schwachstellen Cisco Secure Email Gateway: Kritische Schwachstellen CVE-2026-20353 und CVE-2026-76440 gemeldet #cisco #ciscosecureemailandwebmanager #ciscosecureemailgateway #cve202620353 #cve202676440 https://cybersecurity-news.de/cisco-secure-email-gateway-cve-2026-20353-cve-2026-76440
Post summary
The text announces that critical vulnerabilities CVE-2026-20353 and CVE-2026-76440 in Cisco Secure Email Gateway have been reported. It provides no PoC, exploit, active exploitation, patch, or detailed technical information beyond the CVE identifiers and severity.
0000043
12 followersView on X
ThreatAft@ThreatAft46d
Disclosure
🔐 🚨 CISCO SECURE EMAIL GATEWAY — CVSS 9.8 ×2 CVE-2026-76441: Improper Access Control (CWE-284) CVE-2026-20353: Improper Resource Lifetime (CWE-664) → https://threataft.com/articles/cisco-secure-email-gateway-cve-2026-76441-cve-2026-20353-hardening #Cisco #CVE #EmailSecurity #CVSS9 #PatchNow #CyberSecurity #ThreatIntel
Post summary
The tweet discloses two Cisco Secure Email Gateway vulnerabilities (CVE-2026-76441 and CVE-2026-20353) with technical classifications (CWE and CVSS 9.8) and links to a hardening article, but does not name a specific patch, exploit, PoC, or report active exploitation—making it a vulnerability disclosure.
0000077
43 followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
🚨 CRITICAL — CVE-2026-20353 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-20353 #Cisco #CyberSecurity #InfoSec
Post summary
The tweet discloses CVE-2026-20353 affecting Cisco Secure Email products with a critical CVSS 9.8 score and notes that no patch is available yet, but lacks details on PoCs, exploits, or active exploitation.
0000060
88 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-20353

にゃん☆たく/takumi.a[verified]@taku888infinityActive Exploitation

The text reports that CVE-2026-76461 (SQL Injection → RCE root) was added to CISA KEV and confirms at least one of five related CVEs is actively exploited in the wild.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The post announces two Cisco Secure Email Gateway-related CVEs and provides technical vulnerability details, including SQL injection leading to potential root-level command execution and resource exhaustion leading to DoS. Its primary actionable takeaway is that administrators should apply the relevant security updates.

zoomeyebot[verified]@zoomeyebotDisclosure

The text discloses CVE-2026-20353 as a resource lifetime flaw in Cisco Secure Email Gateway enabling DoS, with ~1.8k exposed instances identifiable via ZoomEye, but provides no PoC, exploit tool, active exploitation evidence, or remediation guidance.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The tweet discloses CVE-2026-20353 affecting Cisco Secure Email products with a critical CVSS 9.8 score and notes that no patch is available yet, but lacks details on PoCs, exploits, or active exploitation.

Autumn Good@autumn_good_35Patch

The post lists several Cisco CVEs and points to a Cisco Security Advisory titled 'Security Hardening Release: September 2026.' It does not mention PoC code, exploit tools, active exploitation, or detailed vulnerability mechanics.

NCIIPC India@NCIIPCPatch

The text announces Cisco's release of software updates addressing critical vulnerabilities in Secure Email products, with a direct call to apply patches via a linked advisory.

Autumn Good@autumn_good_35Active Exploitation

The post highlights multiple Cisco CVEs, explicitly states two are actively exploited in the wild, and links to a Cisco security hardening release advisory as remediation.

Cybersecurity News DE@cybsecuritynewsDisclosure

The text announces that critical vulnerabilities CVE-2026-20353 and CVE-2026-76440 in Cisco Secure Email Gateway have been reported. It provides no PoC, exploit, active exploitation, patch, or detailed technical information beyond the CVE identifiers and severity.