Advisories
Cisco Hardens Secure Email Gateway with Critical Patch for Exploited SQL Injection
Cisco rolled out a hardening update for its Secure Email Gateway and Secure Email & Web Manager after an internal audit uncovered several critical flaws, including a live SQL injection exploit. The fix bundles five CVEs (CVE‑2026‑20353, 76440‑76443) into a single patch with no workarounds, demanding immediate action from customers to maintain email security.
Cisco’s engineering teams just released a hardening update for its Secure Email Gateway and Secure Email & Web Manager. The update comes after an internal security review exposed multiple critical weaknesses, one of which is actively being exploited in the wild.
Key Points
- Five CVEs (CVE‑2026‑20353, 76440‑76441, 76442, 76443) tied to a single underlying CWE class.
- One flaw is a live SQL injection that attackers are already using.
- No workarounds are available; a patch is the only fix.
- Security impact rated as Critical.
"This hardening release is a direct response to vulnerabilities found during internal testing, underscoring Cisco’s proactive stance on product security," says the advisory.
Customers must download and apply the latest firmware/patches immediately to close these gaps. Failure to do so could expose email traffic to injection attacks and other exploitation vectors.
Related vulnerabilities
Critical Cisco Hardening Release: ASA, FTD, FMC Patch Internal Exploits
Cisco’s security team has rolled out a hardening update for its Secure Firewall Adaptive Security Appliance, Threat Defense, and Management Center software, addressing a suite of internally discovered flaws. Eight CVEs (CVE‑2026‑20329 through CVE‑2026‑20336) cover issues ranging from static credential exposure to authentication bypass, with two vulnerabilities already being actively exploited. No workarounds exist; customers must install the patches promptly to mitigate the critical risk.
Read briefing
Cisco Crosswork Hardening Release: Critical CVEs Uncovered in August 2026
Cisco’s Crosswork team has rolled out a hardening update after an internal security audit revealed several critical weaknesses. Four CVEs—CVE‑2026‑20030, CVE‑2026‑20357, CVE‑2026‑20358, and CVE‑2026‑20359—were patched in the new firmware, with no workarounds available. The vulnerabilities were not known to be actively exploited, but the critical rating urges immediate action. Update your Crosswork devices now to stay protected.
Read briefing
Microsoft Unleashes 972 CVE Fixes on Patch Tuesday, Including 2 Exploited Zero‑Days and 113 Critical Flaws
Microsoft’s September 2026 Patch Tuesday update tackles 972 CVEs—two of which are actively exploited zero‑days and 113 critical vulnerabilities. The patch covers Windows, Office, and other Microsoft components, tightening defenses across the ecosystem. Security teams should apply the fixes immediately and monitor for any lingering exploitation attempts.
Read briefing
Citrix NetScaler ADC & Gateway Hit by Dual Critical Flaws – Patch Urgently
Citrix has disclosed two critical security issues in its NetScaler ADC and Gateway appliances. CVE‑2026‑19489 (memory overflow) can trigger DoS when SIP ALG is active on a Large‑Scale NAT group, while CVE‑2026‑19490 (auth bypass) targets Gateway or AAA virtual servers with SAML actions. Affected builds span 13.1 and 14.1 releases, including FIPS variants. CERT‑EU urges all users to apply the latest updates immediately and verify configuration strings to assess risk.
Read briefing