CVE-2026-76443

Published Sep 14, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-76443 is an identifier assigned by Cisco to a group of internally discovered vulnerabilities involving improper neutralization (CWE-707). This vulnerability class encompasses flaws related to command, SQL, and code/eval injection, as well as cross-site scripting. The affected products include Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, regardless of their specific device configurations. The vulnerabilities were identified during an internal security review and addressed through software hardening releases in September 2026. They allow remote, unauthenticated attackers to submit crafted inputs that the affected appliances execute. At the time of disclosure, Cisco reported no evidence of active exploitation in the wild for the specific flaws grouped under this CVE.

Description: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.
Source: psirt@cisco.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@cisco.com: CWE-707

Hype score: Not currently trending

References