CVE-2026-76440
Received Received - Intake

Path Traversal Vulnerabilities in Cisco Secure Email Gateway

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Cisco Systems, Inc.

Description
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76440 are related to path traversal issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-76440
EUVD
EUVD-2026-77622

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
cisco secure_email_gateway *
cisco secure_email_and_web_manager *
cisco secure_email_gateway 15.5.5-014
cisco secure_email_and_web_manager 15.5.5-006

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76440 is a critical path traversal vulnerability (CWE-23) affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. It allows attackers to access unauthorized files or directories by exploiting improper pathname restrictions or link resolution before file access.

Detection Guidance

Detection involves checking for vulnerable versions of Cisco Secure Email Gateway (15.5.5-014 or earlier) and Cisco Secure Email and Web Manager (15.5.5-006 or earlier). Use commands like 'show version' on the appliance or check software update logs for version details.

Impact Analysis

This vulnerability could lead to data breaches or system compromise by allowing attackers to access sensitive files or directories. It may result in unauthorized data exposure, potential system takeover, or further network infiltration if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files or directories, which may result in data breaches. Such breaches could violate compliance requirements under GDPR or HIPAA if personal or health data is exposed. Organizations using affected Cisco products should prioritize patching to mitigate these risks.

Mitigation Strategies

Immediately upgrade to fixed versions: 15.5.5-014 for Secure Email Gateway and 15.5.5-006 for Secure Email and Web Manager. No workarounds are available, so patching is required to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart