# CVE-2026-76440

## Summary

- **CVE ID:** CVE-2026-76440
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-23
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 15, 2026

## Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76440 are related to path traversal issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-23.

## Affected Products

- Cisco — Cisco Secure Email (14.0.0-698)
- Cisco — Cisco Secure Email (13.5.1-277)
- Cisco — Cisco Secure Email (13.0.0-392)
- Cisco — Cisco Secure Email (14.2.0-620)
- Cisco — Cisco Secure Email (13.0.5-007)
- Cisco — Cisco Secure Email (13.5.4-038)
- Cisco — Cisco Secure Email (14.2.1-020)
- Cisco — Cisco Secure Email (14.3.0-032)
- Cisco — Cisco Secure Email (15.0.0-104)
- Cisco — Cisco Secure Email (15.0.1-030)
- Cisco — Cisco Secure Email (15.5.0-048)
- Cisco — Cisco Secure Email (15.5.1-055)
- Cisco — Cisco Secure Email (15.5.2-018)
- Cisco — Cisco Secure Email (16.0.0-050)
- Cisco — Cisco Secure Email (15.0.3-002)
- Cisco — Cisco Secure Email (16.0.0-054)
- Cisco — Cisco Secure Email (15.5.3-022)
- Cisco — Cisco Secure Email (16.0.1-017)
- Cisco — Cisco Secure Email (15.5.4-012)
- Cisco — Cisco Secure Email (16.0.4-016)
- Cisco — Cisco Secure Email (15.0.5-016)
- Cisco — Cisco Secure Email (16.0.2-112)
- Cisco — Cisco Secure Email (16.0.3-044)
- Cisco — Cisco Secure Email (15.5.5-014)
- Cisco — Cisco Secure Email and Web Manager (13.6.2-023)
- Cisco — Cisco Secure Email and Web Manager (13.6.2-078)
- Cisco — Cisco Secure Email and Web Manager (13.0.0-249)
- Cisco — Cisco Secure Email and Web Manager (13.0.0-277)
- Cisco — Cisco Secure Email and Web Manager (13.8.1-052)
- Cisco — Cisco Secure Email and Web Manager (13.8.1-068)
- Cisco — Cisco Secure Email and Web Manager (13.8.1-074)
- Cisco — Cisco Secure Email and Web Manager (14.0.0-404)
- Cisco — Cisco Secure Email and Web Manager (12.8.1-002)
- Cisco — Cisco Secure Email and Web Manager (14.1.0-227)
- Cisco — Cisco Secure Email and Web Manager (13.6.1-201)
- Cisco — Cisco Secure Email and Web Manager (14.2.0-203)
- Cisco — Cisco Secure Email and Web Manager (14.2.0-212)
- Cisco — Cisco Secure Email and Web Manager (12.8.1-021)
- Cisco — Cisco Secure Email and Web Manager (13.8.1-108)
- Cisco — Cisco Secure Email and Web Manager (14.2.0-224)
- Cisco — Cisco Secure Email and Web Manager (14.3.0-120)
- Cisco — Cisco Secure Email and Web Manager (15.0.0-334)
- Cisco — Cisco Secure Email and Web Manager (15.5.1-024)
- Cisco — Cisco Secure Email and Web Manager (15.5.1-029)
- Cisco — Cisco Secure Email and Web Manager (15.5.2-005)
- Cisco — Cisco Secure Email and Web Manager (16.0.0-195)
- Cisco — Cisco Secure Email and Web Manager (15.5.3-017)
- Cisco — Cisco Secure Email and Web Manager (16.0.1-010)
- Cisco — Cisco Secure Email and Web Manager (15.0.1-035)
- Cisco — Cisco Secure Email and Web Manager (16.0.2-088)
- Cisco — Cisco Secure Email and Web Manager (15.5.4-007)
- Cisco — Cisco Secure Email and Web Manager (15.0.2-007)
- Cisco — Cisco Secure Email and Web Manager (16.0.4-010)
- Cisco — Cisco Secure Email and Web Manager (16.0.3-016)
- Cisco — Cisco Secure Email and Web Manager (16.5.0-429)
- Cisco — Cisco Secure Email and Web Manager (15.5.5-006)

## References

- [CNA](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm)
- [CVE](https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.45%
- **EPSS Percentile:** 38.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._