Threat operations/Case file
AL
Member accessPublic view · sign in

Vulnerability threat dossier

CVE-2026-20353

CiscoCisco Secure Email

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

VTP deterministic threat16.6of 100 · CVSS excluded

VTP analyst assessment

Cisco Secure Email critical vulnerability requires vendor-guided remediation

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence78%
Public exploitation · VTP factREPORTED

Assessment

CVE-2026-20353 affects Cisco Secure Email and has a critical CVSS 9.8 rating. Cisco describes this set of issues as internally discovered vulnerabilities addressed through software-hardening releases. BleepingComputer reported exploitation of a Cisco Secure Email Gateway zero-day, but its available summary does not identify CVE-2026-20353; it should not be treated as confirmed exploitation of this CVE.

Why it matters

  • A network-reachable critical flaw could have severe confidentiality, integrity, and availability effects if its specific mechanism is reachable.
  • Cisco has released hardening updates, providing a remediation path for affected deployments.

Evidence

3 record references and 3 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The available reporting does not establish that CVE-2026-20353 was the exploited Secure Email Gateway zero-day.

The bundle does not state the specific vulnerability mechanism or affected versions.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use Cisco Secure Email, identify affected releases and install Cisco's applicable hardening update.

AI baseline history (2)
  1. BASELINE ASSESSED
    Cisco Secure Email critical vulnerability requires vendor-guided remediationgpt-5.6-terra · low
  2. BASELINE ASSESSED
    Cisco Secure Email zero-day exploitation reportedgpt-5.6-terra · low
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationREPORTEDGlobal public evidence
Exploit maturityTECHNICAL DETAILSReliability not implied
EPSS0.0034th percentile · prediction
Evidence confidence60%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    EPSS is 0.00; this is predictive context, not exploitation evidence.

  2. 02

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

CERT ADVISORYNew CERT advisory
VENDOR ADVISORYNew vendor advisory
03

Claim provenance

Evidence and source independence

4publications detected
4underlying evidence chains

2 primary sources · 0 dependent secondary reports · 2 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOITATION REPORTEDPUBLICATION REPORTS EXPLOITATION
60%claim confidence
UNKNOWNreport:3b3366899fc0ff5fe16f5e1cffd57049d2a18ac70347d40ab993104558f71fbcACTIVE
Evidence
04

Event history

Threat timeline

  1. 07:3115 Sept
    EXPLOITATION REPORTED

    Exploitation Reported

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

  2. 00:0015 Sept
    CERT ADVISORY

    New CERT advisory

    CERT-FR published evidence linked to CVE-2026-20353.

  3. 16:0014 Sept
    VENDOR ADVISORY

    New vendor advisory

    Cisco Product Security Incident Response Team published evidence linked to CVE-2026-20353.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker

CVE-2026-20130CVE-2026-20176CVE-2026-20192CVE-2026-20194CVE-2026-20211CVE-2026-20234CVE-2026-20237CVE-2026-20242CVE-2026-20282CVE-2026-20283CVE-2026-20284CVE-2026-20287CVE-2026-20305CVE-2026-20306CVE-2026-20307CVE-2026-20322CVE-2026-20324CVE-2026-20325CVE-2026-20326CVE-2026-20329CVE-2026-20330CVE-2026-20331CVE-2026-20332CVE-2026-20333CVE-2026-20334CVE-2026-20335CVE-2026-20336CVE-2026-20340CVE-2026-20341CVE-2026-20342CVE-2026-20343CVE-2026-20344CVE-2026-20353CVE-2026-20360CVE-2026-20361CVE-2026-76409CVE-2026-76412CVE-2026-76413CVE-2026-76420CVE-2026-76423CVE-2026-76424CVE-2026-76425CVE-2026-76426CVE-2026-76427CVE-2026-76428CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443CVE-2026-76460CVE-2026-76461
Separate evidence group
Original
BleepingComputerPRESSUNKNOWN

Cisco patches Secure Email Gateway zero-day exploited in attacks

Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]

CVE-2025-20393CVE-2026-20079CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76443CVE-2026-76461
Separate evidence group
Original
CERT-FRCERTINDEPENDENT

Multiples vulnérabilités dans les produits Cisco (15 septembre 2026)

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection SQL (SQLi). Cisco indique que la vulnérabilité CVE-2026-76461 est...

CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443CVE-2026-76461
Separate evidence group
Original
Cisco Product Security Incident Response TeamVENDORINDEPENDENT

Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing. One of them is known to be actively exploited. For more information, see Cisco Secure Email Gateway SQL Injection Vulnerability . To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm <br/>Security Impact Rating: Critical <br/>CVE: CVE-2026-20353,CVE-2026-76440,CVE-2026-76441,CVE-2026-76442,CVE-2026-76443

CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score16.6vtp-threat-v1-public
Public exploitation12 / 30
EPSS prediction0.08 / 20
Exploit availability2.5 / 15
Source independence0 / 15
Intelligence recency2 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-664
CPE records
0
Deterministic history records
12
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.