This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes an actively exploited vulnerability and other critical vulnerabilities

Cisco fixes critical and high-severity vulnerabilities in Cisco IOS XR Software, Cisco AsyncOS for Cisco Secure Email Gateway, Cisco Secure Email and Web Manager and Cisco Secure Email Gateway [1]. The most severe vulnerabilities can be found below. Fixed products and their versions: Cisco IOS XR Software - 26.2.2, 26.3.1 [2]. The fixed SMUs can be found at [2]. Cisco AsyncOS for Cisco Secure Email Gateway Software - 15.5.5-014, 16.0.4-302, 16.5.0-780 [3] Cisco Secure Email Gateway - 15.5.5-014, 16.5.0-780 [4] Cisco Secure Email and Web Manager - 15.5.5-006, 16.5.0-429 [4]

Cisco IOS XR Software - DoS (CVE-2026-20274)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can exploit insufficient management of system resources in Cisco IOS XR Software (e.g. a buffer overflow or out-of-bounds memory access) to compromise the confidentiality and integrity of the system or cause a DoS condition [5]. To determine whether your device is running a vulnerable software version, you can use the show version command described at [2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 9. 2026.

Cisco AsyncOS for Cisco Secure Email Gateway - privilege escalation, ACE (CVE-2026-76461)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can perform SQL injection in Cisco AsyncOS for Cisco Secure Email Gateway by sending specially crafted emails and execute arbitrary commands with root privileges [3]. This vulnerability is already being actively exploited [6]. IoCs can be found at [3].

The vulnerability is present in product:

  • Cisco AsyncOS for Cisco Secure Email Gateway; >=15.5, <15.5.5-014; >=16.0, <16.0.4-302; >=16.5, <16.5.0-780;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-76461 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 9. 2026.

Cisco Secure Email Gateway, Secure Email and Web Manager - DoS (CVE-2026-76440)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can use a path traversal attack in Cisco Secure Email and Web Manager and Cisco Secure Email Gateway to compromise the confidentiality and integrity of the system or cause a DoS [4].

The vulnerability is present in products:

  • Cisco Secure Email Gateway; >=15.5, <15.5.5-014; >=16.0, <16.1 ; >=16.5, <16.5.0-780;
  • Cisco Secure Email and Web Manager; >=15.5, <15.5.5-006; >=16.0, <16.1; >=16.5, <16.5.0-429;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 9. 2026.

Cisco Secure Email Gateway, Secure Email and Web Manager - DoS (CVE-2026-76441)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can exploit improper access control in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager to compromise confidentiality and data integrity or perform a DoS [4].

The vulnerability is present in products:

  • Cisco Secure Email Gateway; >=15.5, <15.5.5-014; >=16.0, <16.1 ; >=16.5, <16.5.0-780;
  • Cisco Secure Email and Web Manager; >=15.5, <15.5.5-006; >=16.0, <16.1; >=16.5, <16.5.0-429;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 9. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 15. 9. 2026.

CESNET, z.s.p.o. Logo