CVE-2026-76441

CVE-2026-76441 groups multiple internally discovered improper access control weaknesses (CWE-284) found during a proactive security review of Cisco Secure Email Gateway (the Email Security Appliance, ESA) and Cisco Secure Email and Web Manager (SMA). The 9.8 CVSS 3.1 score (network vector, low attack complexity, no privileges, no user interaction) indicates an unauthenticated remote attacker can trigger the flaw against an affected appliance and gain high-impact compromise of confidentiality, integrity, and availability — in practice, the type of access-control failure that can yield administrative control of the appliance and the mail flow it filters. Any organization running an affected release of these email security or management appliances is potentially exposed, especially where management or service interfaces are reachable from untrusted networks. Cisco addressed the issues in software hardening releases; there is no known public PoC, the CVE is not on CISA's KEV list, and no exploitation has been reported to date.

What to do: Apply Cisco's software hardening releases for Secure Email Gateway and Secure Email and Web Manager exactly as mapped in the PSIRT advisory, prioritizing appliances whose management or listener interfaces are reachable from untrusted networks. As an interim mitigation, restrict management access to trusted administrative subnets or VPN and enforce interface ACLs. Review audit logs and mail-flow policies for unexplained administrative changes or account creation that could indicate prior abuse.