Cisco Secure Email Gateway and Secure Email and Web Manager: hardening release fixes multiple critical vulnerabilities including actively exploited SQL injection and arbitrary file write (CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443)
Severity: critical · Patch status: patched · Since 2026-09-14 · CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443
Cisco released security hardening updates for Secure Email Gateway and Secure Email and Web Manager addressing five internally discovered vulnerability groups, each assigned a CVE by CWE class: path traversal (CWE-23), improper access control (CWE-284), improper resource lifetime control (CWE-664), improper neutralization including SQL injection (CWE-707), and improper input validation (CWE-1284). Two vulnerabilities — the arbitrary file write (path traversal) and SQL injection — are known to be actively exploited. All devices are affected regardless of configuration; Secure Web Appliance is not affected. No workarounds exist. Fixes are available in 15.5.5-014 (Gateway) / 15.5.5-006 (Manager) and 16.5.0-780 / 16.5.0-429; 16.0 users must migrate.
What to do
- Upgrade Cisco Secure Email Gateway to 15.5.5-014 or 16.5.0-780 immediately, prioritising internet-exposed appliances
- Upgrade Cisco Secure Email and Web Manager to 15.5.5-006 or 16.5.0-429
- Migrate any devices on 16.0 to a fixed release
- Check appliances for signs of exploitation (SQL injection and arbitrary file write are actively exploited) and investigate for compromise before and after patching
- Restrict management interface access to trusted networks while patching
Fixed versions
- Secure Email Gateway: 15.5.5-014, 16.5.0-780
- Secure Email and Web Manager: 15.5.5-006, 16.5.0-429
Sources
All live incidents on Threat Watch
