CVE-2026-76440 concerns relative path traversal vulnerabilities in Cisco Secure Email products. The issue was identified through Cisco's internal security review process and grouped under CWE-23 (Relative Path Traversal). This vulnerability allows an attacker to manipulate file paths to access files outside the intended directory, potentially leading to unauthorized disclosure, modification, or disruption of data. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges required, and full confidentiality, integrity, and availability impact. Affected versions include multiple specific builds of Cisco Secure Email ranging from 12.8.1-002 through 16.5.0-429.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, data modification, and potential denial of service, impacting confidentiality, integrity, and availability of the affected Cisco Secure Email systems. The critical CVSS score (9.8) underscores the severity and ease of exploitation without requiring privileges or user interaction.

Cisco has released software hardening updates addressing these vulnerabilities as part of their internal security review. Users should apply the official patches or updates provided by Cisco for the affected versions of Cisco Secure Email. Since this is not a cloud service, remediation depends on customer action to update affected software versions. Patch status is confirmed by Cisco's advisory indicating fixes in released software hardening updates. Users should consult Cisco's official security advisories for detailed patch information and upgrade instructions.