Threat operations/Case file
AL
Member accessPublic view · sign in

Vulnerability threat dossier

CVE-2026-76441

Vendor unknownProduct mapping pending

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76441 are related to issues with improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

VTP deterministic threat16.6of 100 · CVSS excluded

VTP analyst assessment

Reported exploitation of Cisco Secure Email Gateway authorization flaw

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence61%
Public exploitation · VTP factREPORTED

Assessment

BleepingComputer reports exploitation of CVE-2026-76441 in Cisco Secure Email Gateway attacks. The CVE is an authorization weakness, but the supplied material does not state its specific attack path or impact.

Why it matters

  • A weakness in an email security gateway can undermine a control that processes untrusted mail.
  • Cisco released hardening updates for this internally discovered vulnerability set.

Evidence

2 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The exploitation report is not independently corroborated here and lacks CVE-specific mechanics.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use affected Cisco Secure Email Gateway products, apply Cisco hardening releases and review gateway activity for anomalies around the advisory period.

AI baseline history (1)
  1. BASELINE ASSESSED
    Reported exploitation of Cisco Secure Email Gateway authorization flawgpt-5.6-terra · low
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationREPORTEDGlobal public evidence
Exploit maturityTECHNICAL DETAILSReliability not implied
EPSS0.0041th percentile · prediction
Evidence confidence60%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    EPSS is 0.00; this is predictive context, not exploitation evidence.

  2. 02

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

CERT ADVISORYNew CERT advisory
VENDOR ADVISORYNew vendor advisory
03

Claim provenance

Evidence and source independence

4publications detected
4underlying evidence chains

2 primary sources · 0 dependent secondary reports · 2 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOITATION REPORTEDPUBLICATION REPORTS EXPLOITATION
60%claim confidence
UNKNOWNreport:3b3366899fc0ff5fe16f5e1cffd57049d2a18ac70347d40ab993104558f71fbcACTIVE
Evidence
04

Event history

Threat timeline

  1. 07:3115 Sept
    EXPLOITATION REPORTED

    Exploitation Reported

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

  2. 00:0015 Sept
    CERT ADVISORY

    New CERT advisory

    CERT-FR published evidence linked to CVE-2026-76441.

  3. 16:0014 Sept
    VENDOR ADVISORY

    New vendor advisory

    Cisco Product Security Incident Response Team published evidence linked to CVE-2026-76441.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker

CVE-2026-20130CVE-2026-20176CVE-2026-20192CVE-2026-20194CVE-2026-20211CVE-2026-20234CVE-2026-20237CVE-2026-20242CVE-2026-20282CVE-2026-20283CVE-2026-20284CVE-2026-20287CVE-2026-20305CVE-2026-20306CVE-2026-20307CVE-2026-20322CVE-2026-20324CVE-2026-20325CVE-2026-20326CVE-2026-20329CVE-2026-20330CVE-2026-20331CVE-2026-20332CVE-2026-20333CVE-2026-20334CVE-2026-20335CVE-2026-20336CVE-2026-20340CVE-2026-20341CVE-2026-20342CVE-2026-20343CVE-2026-20344CVE-2026-20353CVE-2026-20360CVE-2026-20361CVE-2026-76409CVE-2026-76412CVE-2026-76413CVE-2026-76420CVE-2026-76423CVE-2026-76424CVE-2026-76425CVE-2026-76426CVE-2026-76427CVE-2026-76428CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443CVE-2026-76460CVE-2026-76461
Separate evidence group
Original
BleepingComputerPRESSUNKNOWN

Cisco patches Secure Email Gateway zero-day exploited in attacks

Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]

CVE-2025-20393CVE-2026-20079CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76443CVE-2026-76461
Separate evidence group
Original
CERT-FRCERTINDEPENDENT

Multiples vulnérabilités dans les produits Cisco (15 septembre 2026)

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection SQL (SQLi). Cisco indique que la vulnérabilité CVE-2026-76461 est...

CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443CVE-2026-76461
Separate evidence group
Original
Cisco Product Security Incident Response TeamVENDORINDEPENDENT

Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing. One of them is known to be actively exploited. For more information, see Cisco Secure Email Gateway SQL Injection Vulnerability . To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm <br/>Security Impact Rating: Critical <br/>CVE: CVE-2026-20353,CVE-2026-76440,CVE-2026-76441,CVE-2026-76442,CVE-2026-76443

CVE-2026-20353CVE-2026-76440CVE-2026-76441CVE-2026-76442CVE-2026-76443
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score16.6vtp-threat-v1-public
Public exploitation12 / 30
EPSS prediction0.1 / 20
Exploit availability2.5 / 15
Source independence0 / 15
Intelligence recency2 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-284
CPE records
0
Deterministic history records
11
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.