In plain language
What this advisory means
Cisco found several security weaknesses in its Secure Email Gateway and Secure Email and Web Manager products during internal testing, including two that attackers are exploiting now. These weaknesses could let attackers access or control systems improperly. Cisco has issued software updates to fix these issues and strongly urges customers to upgrade their systems. No temporary workarounds are available.
Technical explanation
How the issue affects the environment
During a comprehensive internal security review, Cisco discovered multiple vulnerabilities in Cisco Secure Email Gateway and Secure Email and Web Manager. These include high-severity issues such as path traversal (CWE-23), improper access control (CWE-284), uncontrolled resource management (CWE-664), improper neutralization leading to injection attacks (CWE-707), and improper input validation (CWE-1284). Two of these vulnerabilities—relating to arbitrary file writes and SQL injections—are known to be actively exploited in the wild. Cisco assigned CVE identifiers to each grouped vulnerability and released software updates with a CVSS base score of up to 9.8 to remediate these critical security flaws. No workarounds are available, so applying the provided software updates is essential.
Operational impact
Why teams should care
Exploitation of these vulnerabilities could allow attackers to gain unauthorized access, execute arbitrary commands, manipulate data, or disrupt email gateway services. Organizations relying on affected Cisco products risk data breaches, service outages, and loss of trust if they do not apply the required software updates promptly.
Immediate action
Cisco strongly recommends customers upgrade their Cisco Secure Email Gateway and Secure Email and Web Manager appliances to the fixed software releases listed. Upgrades may be performed via the device web interface or CLI, following Cisco’s provided procedures. After upgrading, customers should verify device functionality and security posture. Organizations without a current service contract should contact Cisco TAC to obtain upgrades.
Affected and fixed releases
Temporary risk reduction
There are no workarounds available to mitigate these vulnerabilities. Only applying the fixed software updates can address the risks described.
Evidence and validation checklist
- Cisco advisory publication dated September 14, 2026, last updated October 14, 2026
- Cisco PSIRT security advisory https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
- Assigned CVE identifiers and CWE classifications
- Detailed fixed software release matrix and upgrade instructions
- Explicit statement that two vulnerabilities are actively exploited
- No workarounds available stated by Cisco
Authoritative reference
Cisco PSIRT Advisories
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.