CVE-2026-76441Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76441 are related to issues with improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 3d ago at 3 mentions (2026-09-15); latest day: 1
8 total mentions across 5 days

Deep dive

Activity timeline8 mentions / 5d

Signal classification3 categories

Disclosure

450.0%

Active Exploitation

225.0%

Patch

225.0%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	2	Active Exploitation1Disclosure1
2026-09-15	3	Disclosure1Patch2
2026-09-18	1	Disclosure1
2026-09-27	1	Disclosure1
2026-10-15	1	Active Exploitation1

Full discourse8 posts

にゃん☆たく/takumi.a@taku888infinity46d
Active Exploitation
・CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX 『（直訳）Cisco Secure Email Gateway 用の Cisco AsyncOS ソフトウェアのメール解析機能に脆弱性があり、認証されていないリモート攻撃者が、基盤となるオペレーティングシステム上でルート権限で任意のコマンドを実行できる可能性』 →KEV追加・CVE-2026-20353/CVE-2026-76440/CVE-2026-76441/CVE-2026-76442/CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm 『（直訳）これらの脆弱性は、社内テスト中に発見されました。そのうちの1つは、実際に悪用されていることが確認されています。』
Post summary
The post highlights Cisco Secure Email Gateway vulnerabilities and emphasizes exploitation status, including KEV addition for CVE-2026-76461 and confirmation that one related hardening CVE was actually exploited. It provides some technical impact detail but no PoC, exploit tool, or specific patch guidance.
210521.9K
12.0K followersView on X
Autumn Good@autumn_good_3545d
Patch
🚨🚨🚨 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Post summary
The announcement highlights a Cisco security hardening release for September 2026 that addresses multiple CVEs, indicating a patch is available.
00031483
7.3K followersView on X
NCIIPC India@NCIIPC45d
Patch
#Cisco has released software updates to address #Critical vulnerabilities in Secure Email Gateway and Secure Email and Web Manager. Apply Updates! #CVE-2026-76440 #CVE-2026-76441 #CVE-2026-20353 #CVE-2026-76443 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-hardening-esa-dfCrfXkm.html
Post summary
Cisco released software updates to address critical vulnerabilities (CVE‑2026‑76440, CVE‑2026‑76441, CVE‑2026‑20353, CVE‑2026‑76443) in its Secure Email Gateway and Secure Email and Web Manager; customers should apply the updates.
00020340
8.5K followersView on X
Autumn Good@autumn_good_3515d
Active Exploitation
🚨🚨🚨 『Two of them are known to be actively exploited.』 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Post summary
The text announces five CVEs affecting Cisco Secure Email products, explicitly states that two are known to be actively exploited in the wild, and links to a Cisco Security Hardening Release advisory as remediation.
10000465
7.3K followersView on X
Hong Kong Programming Society@hkprogsociety34d
Disclosure
CVE-2026-76441: Improper Access Control in Cisco Secure Email Gateway Exposes Restricted Functions https://www.worldprogramming.org/posts/cve-2026-76441-improper-access-control-in-cisco-secure-email-gateway-exposes-restricted-functions-hzyjsy https://t.co/BO1ilKRWrG
Post summary
The text announces CVE-2026-76441, detailing the vulnerability type and impact on Cisco Secure Email Gateway, but contains no evidence of active exploitation, exploit tools, or available patches.
00000101
63 followersView on X
zoomeyebot@zoomeyebot43d
Disclosure
🚨 Cisco Secure Email Gateway and Email and Web Manager: Critical Improper Access Control (CVE-2026-76441) Critical Vulnerability Alert! Cisco Secure Email Gateway and Cisco Secure Email and Web Manager 15.5 and earlier is affected by CVE-2026-76441. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco Secure Email Gateway" Exposure: 1.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBTZWN1cmUgRW1haWwgR2F0ZXdheSI%3D #CVE2026_76441 #Cisco #EmailSecurity #InfoSec #ZoomEye
Post summary
The text announces a critical Cisco CVE involving improper access control and lists affected products and versions. It also references ZoomEye for discovering exposed instances, but does not provide PoC, exploit code, active exploitation evidence, or remediation guidance.
0000052
23 followersView on X
ThreatAft@ThreatAft46d
Disclosure
🔐 🚨 CISCO SECURE EMAIL GATEWAY — CVSS 9.8 ×2 CVE-2026-76441: Improper Access Control (CWE-284) CVE-2026-20353: Improper Resource Lifetime (CWE-664) → https://threataft.com/articles/cisco-secure-email-gateway-cve-2026-76441-cve-2026-20353-hardening #Cisco #CVE #EmailSecurity #CVSS9 #PatchNow #CyberSecurity #ThreatIntel
Post summary
The text discloses two CVEs (CVE-2026-76441 and CVE-2026-20353) affecting Cisco Secure Email Gateway, providing technical details, CVSS scores, and vulnerability types, but does not mention active exploitation, patches, or exploit tools.
0000077
43 followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
🚨 CRITICAL — CVE-2026-76441 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cis… CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-76441 #Cisco #CyberSecurity #InfoSec
Post summary
The tweet announces a critical vulnerability (CVE-2026-76441) with a CVSS 9.8 score affecting Cisco Secure Email Gateway, noting no patch is available yet and linking to a full analysis for details.
0000064
88 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-76441

にゃん☆たく/takumi.a[verified]@taku888infinityActive Exploitation

The post highlights Cisco Secure Email Gateway vulnerabilities and emphasizes exploitation status, including KEV addition for CVE-2026-76461 and confirmation that one related hardening CVE was actually exploited. It provides some technical impact detail but no PoC, exploit tool, or specific patch guidance.

zoomeyebot[verified]@zoomeyebotDisclosure

The text announces a critical Cisco CVE involving improper access control and lists affected products and versions. It also references ZoomEye for discovering exposed instances, but does not provide PoC, exploit code, active exploitation evidence, or remediation guidance.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The tweet announces a critical vulnerability (CVE-2026-76441) with a CVSS 9.8 score affecting Cisco Secure Email Gateway, noting no patch is available yet and linking to a full analysis for details.

Autumn Good@autumn_good_35Patch

The announcement highlights a Cisco security hardening release for September 2026 that addresses multiple CVEs, indicating a patch is available.

NCIIPC India@NCIIPCPatch

Cisco released software updates to address critical vulnerabilities (CVE‑2026‑76440, CVE‑2026‑76441, CVE‑2026‑20353, CVE‑2026‑76443) in its Secure Email Gateway and Secure Email and Web Manager; customers should apply the updates.

Autumn Good@autumn_good_35Active Exploitation

The text announces five CVEs affecting Cisco Secure Email products, explicitly states that two are known to be actively exploited in the wild, and links to a Cisco Security Hardening Release advisory as remediation.

Hong Kong Programming Society@hkprogsocietyDisclosure

The text announces CVE-2026-76441, detailing the vulnerability type and impact on Cisco Secure Email Gateway, but contains no evidence of active exploitation, exploit tools, or available patches.

ThreatAft@ThreatAftDisclosure

The text discloses two CVEs (CVE-2026-76441 and CVE-2026-20353) affecting Cisco Secure Email Gateway, providing technical details, CVSS scores, and vulnerability types, but does not mention active exploitation, patches, or exploit tools.