Key points
- Cisco issued a critical security advisory for September 2026 hardening releases.
- Five CVEs were assigned to group underlying vulnerability classes.
- Two of the internal findings are confirmed to be actively exploited.
Cisco has released software updates for its Secure Email Gateway and Secure Email and Web Manager to address multiple security vulnerabilities. The vendor conducted an internal review that identified these flaws during testing. Two of the discovered issues are known to be actively exploited, according to the Cisco PSIRT advisory. The company rates the overall security impact as critical.
These vulnerabilities affect the specified products regardless of how the devices are configured. Cisco confirmed that the Secure Web Appliance is not affected by these specific issues. The advisory covers five Common Vulnerabilities and Exposures identifiers, which group the bugs by their underlying weakness class.
By the numbers
- 5 CVE IDs assigned to group vulnerability classes in this release.
- 2 vulnerabilities confirmed to be under active exploitation.
- 1 advisory covers both Secure Email Gateway and Web Manager.
What the figures mean
The grouping of vulnerabilities into five CVEs simplifies the patching process for administrators. Each identifier represents the maximum severity of the flaws within that specific category. The active exploitation of two issues indicates that threat actors are already targeting these weaknesses in the wild.
The affected vulnerability classes include SQL injection, arbitrary file write, path traversal, improper access control, and resource consumption issues. Cisco states that there are no workarounds to mitigate these risks. Customers must upgrade to the fixed software releases to remediate the exposure.
What should you do?
Managed service providers should immediately check their inventory of Cisco Secure Email Gateway and Web Manager appliances. Identify any devices running vulnerable software versions listed in the advisory. Plan for network upgrades using the system administration interface to apply the fixes.
Prioritize systems that are exposed to the internet or handle sensitive email traffic. Verify that the upgrade process completes successfully and that services restart correctly. Monitor logs for signs of exploitation activity while preparing the patch deployment schedule.
Operational impact
Teams usually need to assess which client environments rely on the affected gateway models. Check whether internal change management policies require maintenance windows for such critical patches. Identify the vendors or partners who manage these appliances on your behalf. Notify the security operations center and the procurement team about the urgency. Ensure that backup procedures are in place before initiating the software upgrades.
What to do and how to stay safe: Cisco
- Download the latest software images from the Cisco support portal for your specific appliance models.
- Test the upgrade in a non-production environment to verify compatibility with current configurations.
- Schedule the deployment during a maintenance window to minimize service disruption for email users.
- Monitor system logs after the upgrade to confirm the new version is running and stable.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are there any temporary workarounds for these vulnerabilities?
No, Cisco states that there are no workarounds available to address these specific vulnerabilities.
Which Cisco products are affected by this advisory?
The advisory affects Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
Does this advisory affect the Cisco Secure Web Appliance?
No, Cisco confirmed that these vulnerabilities do not affect the Secure Web Appliance.
