# CVE-2026-76443: Cisco Secure Email Gateway improper neutralization vulnerability

Source: https://junglewise.ai/threats/cve-2026-76443-cisco-secure-email-gateway-improper-neutralization-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76443 · Severity: critical · CVSS 9.8 · Published 2026-09-14

Cisco Secure Email Gateway and Secure Email and Web Manager are critical email security appliances that protect organizational communications from threats. CVE-2026-76443 represents a class of improper neutralization vulnerabilities (including SQL injection) that allow unauthenticated remote attackers to execute malicious code or commands on the appliances, potentially leading to complete compromise of email security, data theft, and service disruption. At least one vulnerability in this class is known to be actively exploited in the wild.

Technologies: [Cisco Secure Email and Web Manager](https://junglewise.ai/threats/technologies/secure-email-and-web-manager), [Cisco Secure Email Gateway](https://junglewise.ai/threats/technologies/secure-email-gateway). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76443 being exploited in the wild.

**How severe is CVE-2026-76443?** Critical severity, with a CVSS score of 9.8, published 14 September 2026.

**Which products and versions are affected?** Cisco Secure Email and Web Manager 15.5 and earlier, 16.0, 16.5 before 16.5.0-429; Cisco Secure Email Gateway 15.5 and earlier, 16.0, 16.5 before 16.5.0-780.

**Is there a fix for CVE-2026-76443?** A patch was published: Fixed releases available: SEG 15.5.5-014, 16.5.0-780; SEWM 15.5.5-006, 16.5.0-429 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76443 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76443?** Check whether you run Cisco Secure Email and Web Manager or Cisco Secure Email Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-76443 encompasses multiple improper neutralization vulnerabilities grouped under CWE-707, including SQL injection, command injection, and code injection flaws. The vulnerabilities affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager regardless of configuration. These are network-reachable vulnerabilities requiring no authentication or user interaction (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers can achieve remote code execution or arbitrary command execution to fully compromise the appliance. Cisco has released patched versions: Secure Email Gateway 15.5.5-014+ and 16.5.0-780+; Secure Email and Web Manager 15.5.5-006+ and 16.5.0-429+. No workarounds are available.

## Affected products

- Cisco Secure Email Gateway 15.5 and earlier, 16.0, 16.5 before 16.5.0-780
- Cisco Secure Email and Web Manager 15.5 and earlier, 16.0, 16.5 before 16.5.0-429

## Timeline

- 2026-09-14: disclosed: CVE-2026-76443 published
- exploited: At least one vulnerability in this CWE-707 class is known to be actively exploited
- patched: Fixed releases available: SEG 15.5.5-014, 16.5.0-780; SEWM 15.5.5-006, 16.5.0-429

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm)
- [https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification](https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification)

## Related threats

- [Cisco Secure Email Gateway relative path traversal](https://junglewise.ai/threats/cve-2026-76519-cisco-secure-email-gateway-relative-path-traversal-vulnerability)
- [Cisco Secure Email Gateway SQL injection](https://junglewise.ai/threats/cve-2026-76461-cisco-secure-email-gateway-sql-injection)
- [Cisco Secure Email Gateway improper input validation](https://junglewise.ai/threats/cve-2026-76442-cisco-secure-email-gateway-improper-input-validation)
- [Cisco Secure Email Gateway access control bypass](https://junglewise.ai/threats/cve-2026-76441-cisco-secure-email-gateway-access-control-bypass)
- [Cisco Secure Email Gateway path traversal](https://junglewise.ai/threats/cve-2026-76440-cisco-secure-email-gateway-path-traversal)