CVE-2026-76442

Cisco Secure Email Gateway Security Hardening Release

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.17.5High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-14Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your organization runs Cisco Secure Email.
Ask your Cisco support contact which releases are affected and whether a hardened release is available for your deployment.
Until Cisco provides a confirmed fixed version, keep the email-management interface off the public internet and limit access to trusted administrators and networks.
Watch for repeated failed connections or sudden service interruptions, and contact Cisco support if they occur.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.

In plain language

Written by AI from the record

Cisco Secure Email has a flaw that can let an outsider disrupt the service, and small businesses using it should act now because public attack code is available.

Network-reachable denial of service caused by improper validation of a supplied quantity value (CWE-1284) in Cisco Secure Email and related management software.

If you're affected

Email service disruption
Delayed business communications
Management console outage
Operational disruption

What is it

This is a weakness in how the software handles certain size or quantity information sent to it. It is like a mailroom accepting an impossible delivery request that jams the sorting equipment: an attacker may be able to make the email service unavailable.

Who is affected

This matters to you if you run Cisco Secure Email for company email protection or administration. It is especially relevant where outsiders can reach the service or its management interface over the internet.

How urgent is it

Public attack code is available, so attackers have a starting point for trying to disrupt exposed systems. Treat this as urgent: reduce internet exposure now and get Cisco’s confirmed remediation guidance as soon as possible.

What to do — in detail

Confirm the deployed Cisco Secure Email release and whether its email-processing or management interfaces are reachable from untrusted networks. Cisco has not published fix or patch information in the available findings, so there is no confirmed target version or branch-specific upgrade path to provide yet; obtain this directly from Cisco support before scheduling an upgrade.

If patching is delayed, restrict management access to a VPN or allowlisted administrator networks, remove any unnecessary public exposure, and preserve logs for unexpected connection spikes, crashes, or service restarts. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor Cisco advisories and support communications for the hardened release, affected-version scope, and any validated workaround.

Technical context

CVSS v3.1 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a remotely reachable availability impact without privileges or user interaction. The reported weakness is CWE-1284, improper validation of specified quantity in input. Public exploit code is available, but the findings do not confirm exploitation in the wild; CISA KEV does not list this CVE. EPSS is 0.4% (29th percentile) with a flat trend. Patch availability and affected version ranges are not yet known.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 3 days, from the signal feeds we watch.

2026-09-17OpenVAS check added
2026-09-16Record updated
2026-09-15Record updatedrecord updated
2026-09-14Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Secure EmailNetworking Infrastructure
- Cisco Secure Email and Web ManagerNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-1284No name in the record

Sources

References in the record

In the news

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active AttacksThe Hacker News · 2026-09-17

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Cisco Secure Email, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account