CVE-2026-76440Active Exploitation

・CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX 『（直訳）Cisco Secure Email Gateway 用の Cisco AsyncOS ソフトウェアのメール解析機能に脆弱性があり、認証されていないリモート攻撃者が、基盤となるオペレーティングシステム上でルート権限で任意のコマンドを実行できる可能性』 →KEV追加 ・CVE-2026-20353/CVE-2026-76440/CVE-2026-76441/CVE-2026-76442/CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm 『（直訳）これらの脆弱性は、社内テスト中に発見されました。そのうちの1つは、実際に悪用されていることが確認されています。』

🚨 Cisco Secure Email Gateway and Email and Web Manager hit by five critical flaws (CVE-2026-76440) Critical Vulnerability Alert! Cisco Secure Email Gateway and Cisco Secure Email and Web Manager 15.5 and earlier is affected by CVE-2026-76440. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco Secure Email Gateway" Exposure: 1.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBTZWN1cmUgRW1haWwgR2F0ZXdheSI%3D #Infosec #CyberSecurity #ZoomEye

🚨🚨🚨 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

🚨 CVE-2026-76519 — Cisco Secure Email Gateway, unauth file write to root. CVSS 9.8. KEV Oct 14. Who should care: physical or virtual Cisco Secure Email Gateway (AsyncOS) where the File Reputation service (part of AMP) is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected. This is the second exploited SEG flaw since mid-September (after CVE-2026-76461). What broke: the gateway does not safely handle email attachments when file reputation is on. An attacker who can send mail through the appliance attaches a crafted file. No login. That can write arbitrary files on the underlying OS and run commands as root. Status: Cisco PSIRT confirmed active exploitation in October. CISA added it to KEV on 14 Oct. Federal due date 17 Oct. Fixes first shipped 14 Sep (originally under CVE-2026-76440) in AsyncOS 15.5.5-014 and 16.5.0-780. Fix today: upgrade to AsyncOS 15.5.5-014 or 16.5.0-780, or update Content Scanner Tools to 25.3.0.5525 or later (no software upgrade or restart required). Customers on the 16.0 branch should migrate to a fixed release. There are no workarounds. Can't patch: there is no durable workaround. Isolate the appliance from untrusted mail paths if you can, but the fix is the only real remediation. Hunt: look for log messages “Suspected compromise indicator was found. Contact TAC for further recommendations” or “Security scan did not complete. Contact TAC for further recommendations.” Also check external firewall/network logs for unexpected outbound uploads — attackers with root can hide evidence on the box itself. Do this now: check whether File Reputation is on and your Content Scanner Tools version. If you are below 25.3.0.5525, update it or the AsyncOS build and reply “patched.” Source: Cisco cisco-sa-esa-afw-zqYJkjxp / CISA KEV #Cisco #SEG #EmailGateway

#Cisco has released software updates to address #Critical vulnerabilities in Secure Email Gateway and Secure Email and Web Manager. Apply Updates! #CVE-2026-76440 #CVE-2026-76441 #CVE-2026-20353 #CVE-2026-76443 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-hardening-esa-dfCrfXkm.html

🚨🚨🚨 『Two of them are known to be actively exploited.』 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CVE-2026-76440 app="Cisco Secure Email Gateway" https://zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBTZWN1cmUgRW1haWwgR2F0ZXdheSI%3D #Infosec #CyberSecurity #ZoomEye @zoomeyebot

Cisco listed fixed builds for an exploited Secure Email Gateway bug on September 14. The CVE for that bug arrived on October 14. September 14 was a security hardening release. Cisco grouped internally found bugs by weakness class and "assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping." Path traversal, CWE-23, went under CVE-2026-76440. Fixed builds: 15.5.5-014 and 16.5.0-780. For 16.0, migrate. October 14 was CVE-2026-76519, CVSS 9.8, an arbitrary file write in Advanced Malware Protection, classed CWE-23. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Same fixed builds. CISA added it to KEV that day. The September advisory now reads, under CVE-2026-76440: "One vulnerability that belongs to this vulnerability class is known to be actively exploited." If your tracker keys on CVE IDs, this bug had no ID of its own for a month while the fixed builds were already listed. Cisco also ships the fix in Content Scanner Tools 25.3.0.5525 and later, to "all licensed and supported Cisco AsyncOS Software releases," and updating it "does not require a software upgrade or a product restart." The patch is the easy part. The compromise check is grep "System Security" system_logs on each cluster device, plus network and firewall logs outside the appliance, because attackers "may remove or hide evidence of exploitation and indicators of compromise." Cisco warns private SSH keys shared between cluster members could be accessed on a compromised appliance, and recommends restoring every member of a cluster with at least one compromised appliance. Does your vulnerability tracker key on CVE IDs, or on fixed releases?

Cisco confirmó ataques contra CVE-2026-76519 en Secure Email Gateway: un correo con un adjunto manipulado basta para escribir archivos y ejecutar comandos como root, sin login. CVSS 9,8. Es la segunda falla de SEG explotada desde mediados de septiembre. Condiciones para estar expuesto (advisory Cisco vía BleepingComputer, 14 oct): • File Reputation activado y asignado a una mail policy. • Content Scanner Tools en versión anterior a 25.3.0.5525. Cómo revisarlo: • CLI: contentscannerstatus para ver la versión de Content Scanner Tools. • GUI: Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection > “Enable File Reputation”. El arreglo no es nuevo: salió el 14 sep en 15.5.5-014 y 16.5.0-780, agrupado bajo CVE-2026-76440. El 14 oct Cisco actualizó el aviso para decir que ya se explota (SecurityWeek, 15 oct). Ojo con los logs: si ves “System Security: Suspected compromise indicator was found”, sigue las recomendaciones del advisory y abre caso con TAC. Cisco advierte que el atacante puede borrar evidencia con root, así que cruza también los logs de firewall y de red. Si hubo compromiso, Cisco pide renovar credenciales y material criptográfico del appliance y restringir el acceso a él. Shadowserver ve casi 300 SEG expuestos en Internet. CISA la agregó al KEV con plazo 17 oct y triage forense.

#schwachstellen Cisco Secure Email Gateway: Kritische Schwachstellen CVE-2026-20353 und CVE-2026-76440 gemeldet #cisco #ciscosecureemailandwebmanager #ciscosecureemailgateway #cve202620353 #cve202676440 https://cybersecurity-news.de/cisco-secure-email-gateway-cve-2026-20353-cve-2026-76440

🚨 CRITICAL — CVE-2026-76440 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cis… CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-76440 #Cisco #CyberSecurity #InfoSec