CVE-2026-76443Active Exploitation

HIGHCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.

Back to dashboard

6.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-707

Priority

HIGH

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 3 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
8 mentions across 6 observed days

What's happening

Active exploitation reported across 3 signals
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 5d ago at 2 mentions (2026-09-14); latest day: 1
8 total mentions across 6 days

Deep dive

Activity timeline8 mentions / 6d

Signal classification3 categories

Active Exploitation

342.9%

Disclosure

228.6%

Patch

228.6%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	2	Active Exploitation1Disclosure1
2026-09-15	2	Patch2
2026-09-19	1	Disclosure1
2026-10-15	1	Active Exploitation1
2026-10-19	1	Active Exploitation1

Full discourse8 posts

Stephen Fewer@stephenfewer11d
Active Exploitation
Three new @metasploit exploit modules in the queue for several of the recent Cisco Secure Email Gateway vulns. Last weeks file write in AMP (CVE-2026-76519, on KEV), and two separate SQLi's (CVE-2026-76461, on KEV, and CVE-2026-76443) from last month: https://github.com/rapid7/metasploit-framework/pulls?q=is%3Apr+%22Cisco+Secure+Email+Gateway%22 https://t.co/DRwZxllrtr
Post summary
The tweet announces three new Metasploit exploit modules targeting Cisco Secure Email Gateway vulnerabilities, with two of the CVEs listed on CISA KEV, confirming active exploitation in the wild.
05022111.6K
10.1K followersView on X
にゃん☆たく/takumi.a@taku888infinity46d
Active Exploitation
・CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX 『（直訳）Cisco Secure Email Gateway 用の Cisco AsyncOS ソフトウェアのメール解析機能に脆弱性があり、認証されていないリモート攻撃者が、基盤となるオペレーティングシステム上でルート権限で任意のコマンドを実行できる可能性』 →KEV追加・CVE-2026-20353/CVE-2026-76440/CVE-2026-76441/CVE-2026-76442/CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm 『（直訳）これらの脆弱性は、社内テスト中に発見されました。そのうちの1つは、実際に悪用されていることが確認されています。』
Post summary
The tweet reports that CVE‑2026‑76461 is now in CISA’s KEV list and that multiple CVEs from September 2026’s hardening release include at least one already confirmed in the wild, highlighting active exploitation and a SQLi‑based RCE vector.
210521.9K
12.0K followersView on X
Autumn Good@autumn_good_3545d
Patch
🚨🚨🚨 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Post summary
The text announces multiple CVEs affecting Cisco Secure Email Gateway and Secure Email and Web Manager, linking to a Cisco Security Advisory for a September 2026 hardening release (patch), but provides no technical vulnerability details, PoC, or exploitation information.
00031483
7.3K followersView on X
NCIIPC India@NCIIPC45d
Patch
#Cisco has released software updates to address #Critical vulnerabilities in Secure Email Gateway and Secure Email and Web Manager. Apply Updates! #CVE-2026-76440 #CVE-2026-76441 #CVE-2026-20353 #CVE-2026-76443 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-hardening-esa-dfCrfXkm.html
Post summary
Cisco has released software updates to address four critical vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) in Secure Email Gateway and Secure Email and Web Manager, urging users to apply the patches immediately.
00020340
8.5K followersView on X
Autumn Good@autumn_good_3515d
Active Exploitation
🚨🚨🚨 『Two of them are known to be actively exploited.』 CVE-2026-20353 CVE-2026-76440 CVE-2026-76441 CVE-2026-76442 CVE-2026-76443 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Post summary
The text announces five Cisco CVEs, explicitly states that two are actively exploited in the wild, and links to a Cisco Security Hardening Release advisory for remediation.
10000465
7.3K followersView on X
dbugs@ptdbugs2d
A PoC/exploit has been discovered for vulnerability CVE-2026-76443 PT ID: PT-2026-91269 Read on dbugs: https://dbu.gs/vulnerability/PT-2026-91269 Vendor: Cisco Products: • Cisco Secure Email • Cisco Secure Email and Web Manager Description: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707. Link: https://www.rapid7.com/db/modules/exploit/unix/smtp/cisco_secure_email_gateway_smime_sqli_rce/
00000324
4.0K followersView on X
zoomeyebot@zoomeyebot41d
Disclosure
🚨 Cisco Secure Email Gateway and Email and Web Manager Hardening Release (CVE-2026-76443) Critical Vulnerability Alert! Cisco Secure Email Gateway and Cisco Secure Email and Web Manager (15.5 and earlier) is affected by CVE-2026-76443. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco Secure Email Gateway" Exposure: 1.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBTZWN1cmUgRW1haWwgR2F0ZXdheSI%3D #Cisco #CVE202676443 #EmailSecurity #Vulnerability #ZoomEye
Post summary
The tweet discloses CVE-2026-76443 as a critical vulnerability affecting Cisco Secure Email Gateway and Email and Web Manager versions 15.5 and earlier, and shares a ZoomEye dork to locate ~1.8k exposed instances globally.
0000047
23 followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
🚨 CRITICAL — CVE-2026-76443 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cis… CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-76443 #Cisco #CyberSecurity #InfoSec
Post summary
The text announces CVE-2026-76443 affecting Cisco Secure Email Gateway with a CVSS 9.8 critical rating, notes no patch is available, and links to a full analysis — characteristic of a vulnerability disclosure post.
0000051
88 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-76443

Stephen Fewer[verified]@stephenfewerActive Exploitation

The tweet announces three new Metasploit exploit modules targeting Cisco Secure Email Gateway vulnerabilities, with two of the CVEs listed on CISA KEV, confirming active exploitation in the wild.

にゃん☆たく/takumi.a[verified]@taku888infinityActive Exploitation

The tweet reports that CVE‑2026‑76461 is now in CISA’s KEV list and that multiple CVEs from September 2026’s hardening release include at least one already confirmed in the wild, highlighting active exploitation and a SQLi‑based RCE vector.

zoomeyebot[verified]@zoomeyebotDisclosure

The tweet discloses CVE-2026-76443 as a critical vulnerability affecting Cisco Secure Email Gateway and Email and Web Manager versions 15.5 and earlier, and shares a ZoomEye dork to locate ~1.8k exposed instances globally.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The text announces CVE-2026-76443 affecting Cisco Secure Email Gateway with a CVSS 9.8 critical rating, notes no patch is available, and links to a full analysis — characteristic of a vulnerability disclosure post.

Autumn Good@autumn_good_35Patch

The text announces multiple CVEs affecting Cisco Secure Email Gateway and Secure Email and Web Manager, linking to a Cisco Security Advisory for a September 2026 hardening release (patch), but provides no technical vulnerability details, PoC, or exploitation information.

NCIIPC India@NCIIPCPatch

Cisco has released software updates to address four critical vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) in Secure Email Gateway and Secure Email and Web Manager, urging users to apply the patches immediately.

Autumn Good@autumn_good_35Active Exploitation

The text announces five Cisco CVEs, explicitly states that two are actively exploited in the wild, and links to a Cisco Security Hardening Release advisory for remediation.