# CVE-2026-20353: Cisco Secure Email Gateway improper resource control

Source: https://junglewise.ai/threats/cve-2026-20353-cisco-secure-email-gateway-improper-resource-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20353 · Severity: critical · CVSS 9.8 · Published 2026-09-14

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain multiple critical vulnerabilities in resource management and access control discovered during an internal security review. These flaws could allow remote attackers to gain unauthorized access, manipulate files, or consume resources without authentication, potentially leading to service disruption, data theft, or system compromise. One vulnerability in this category is known to be actively exploited in the wild.

Technologies: [Cisco Secure Email and Web Manager](https://junglewise.ai/threats/technologies/secure-email-and-web-manager), [Cisco Secure Email Gateway](https://junglewise.ai/threats/technologies/secure-email-gateway). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20353 being exploited in the wild.

**How severe is CVE-2026-20353?** Critical severity, with a CVSS score of 9.8, published 14 September 2026.

**Which products and versions are affected?** Cisco Secure Email and Web Manager 15.5 and earlier, 16.0, 16.5; Cisco Secure Email Gateway 15.5 and earlier, 16.0, 16.5.

**Is there a fix for CVE-2026-20353?** A patch was published on 2026-09-14: Fixed releases available: ESG 15.5.5-014, 16.5.0-780; ESWM 15.5.5-006, 16.5.0-429 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20353 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20353?** Check whether you run Cisco Secure Email and Web Manager or Cisco Secure Email Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerabilities grouped under CVE-2026-20353 involve improper control of resources through their lifetime (CWE-664), including issues with uncontrolled resource consumption, deserialization, and improper resource initialization. Additional hardening releases address related vulnerability classes including path traversal (CWE-23), access control bypass (CWE-284), injection attacks (CWE-707), and input validation flaws (CWE-1284). These are network-reachable services with no authentication required for exploitation (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Cisco has released fixed software versions: Secure Email Gateway 15.5.5-014 and 16.5.0-780; Secure Email and Web Manager 15.5.5-006 and 16.5.0-429. No workarounds are available.

## Affected products

- Cisco Secure Email Gateway 15.5 and earlier, 16.0, 16.5
- Cisco Secure Email and Web Manager 15.5 and earlier, 16.0, 16.5

## Timeline

- 2026-09-14: disclosed
- exploited: One vulnerability in this grouping (related to SQL injection) is known to be actively exploited
- 2026-09-14: patched: Fixed releases available: ESG 15.5.5-014, 16.5.0-780; ESWM 15.5.5-006, 16.5.0-429

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm)
- [https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification](https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification)

## Related threats

- [Cisco Secure Email Gateway relative path traversal](https://junglewise.ai/threats/cve-2026-76519-cisco-secure-email-gateway-relative-path-traversal-vulnerability)
- [Cisco Secure Email Gateway SQL injection](https://junglewise.ai/threats/cve-2026-76461-cisco-secure-email-gateway-sql-injection)
- [Cisco Secure Email Gateway improper neutralization vulnerability](https://junglewise.ai/threats/cve-2026-76443-cisco-secure-email-gateway-improper-neutralization-vulnerability)
- [Cisco Secure Email Gateway improper input validation](https://junglewise.ai/threats/cve-2026-76442-cisco-secure-email-gateway-improper-input-validation)
- [Cisco Secure Email Gateway access control bypass](https://junglewise.ai/threats/cve-2026-76441-cisco-secure-email-gateway-access-control-bypass)