Cisco week 38 2026: two exploited flaws lead 85 CVEs across ISE, email and firewalls

The release at a glance

Cisco's week 38 2026 release covers 85 CVEs in scope for our readers during 14–20 September 2026. Of these, 29 are rated critical, 26 high, 29 medium and 1 low. Two vulnerabilities are noted as actively exploited and appear in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-76461, a SQL injection flaw in Cisco Secure Email Gateway, and CVE-2026-76460, an authentication bypass in Cisco Identity Services Engine (ISE). Both are rated critical.

The most serious remaining issues cluster around network-facing management and identity components: Cisco ISE and ISE-PIC, Cisco Secure Firewall ASA/FTD/FMC, Cisco Nexus Dashboard, and Cisco Secure Email.

What matters most

The two issues to review first are both actively exploited.

Cisco Secure Email — CVE-2026-76461 is a critical SQL injection in AsyncOS email parsing. An unauthenticated, remote attacker can send a crafted email containing malicious SQL statements and then execute commands with root privileges. Cisco PSIRT confirms active exploitation; CISA KEV lists a due date of 17 September 2026.

Cisco Identity Services Engine and ISE-PIC — CVE-2026-76460 is an actively exploited authentication bypass on an API endpoint. Cisco advises upgrading to a fixed release, and CISA KEV sets a due date of 19 September 2026. CVE-2026-76423 is a separate critical REST API authentication bypass that can give an unauthenticated remote attacker administrative access. The ISE hardening release also includes access-control issues with a CVSS base score of 10, represented by CVE-2026-20192, and CVE-2026-20307 is remote code execution through insecure deserialisation in the ISE web interface, requiring low-privileged administrative credentials.

Cisco Secure Firewall ASA/FTD/FMC — CVE-2026-20324 in FMC's sftunnel protocol allows an authenticated remote attacker to write a file that is then executed with root privileges. The related hardening release, represented by CVE-2026-20329, covers exceptional-condition issues across ASA, FTD and FMC, with other CVEs covering neutralisation and access control.

Cisco Nexus Dashboard — CVE-2026-20322 is a representative hardening-release issue for improper access control, with related command-injection issues in the same release.

Patch in this order

1. Patch Cisco Secure Email (AsyncOS) for CVE-2026-76461 first. Fixed versions are AsyncOS 15.5.5-014, 16.0.4-302 and 16.5.0-780. CISA KEV lists a due date of 17 September 2026; exploitation is active.
2. Patch Cisco Identity Services Engine for CVE-2026-76460. Cisco advises upgrading to a fixed software release. CISA KEV lists a due date of 19 September 2026; exploitation is active.
3. Patch internet-facing Cisco ISE and ISE-PIC for CVE-2026-76423 and the hardening-release access-control issues represented by CVE-2026-20192. These are unauthenticated remote issues rated critical.
4. Patch the ISE web management interface for CVE-2026-20307, but after unauthenticated API issues because exploitation requires low-privileged administrative credentials.
5. Patch Cisco Secure Firewall FMC, ASA and FTD for the hardening-release issues represented by CVE-2026-20329 and for CVE-2026-20324. Prioritise FMC deployments with registered sftunnel peers.
6. Patch Cisco Nexus Dashboard for CVE-2026-20322 and related command-injection issues.
7. Then work through the remaining release: 29 critical, 26 high, 29 medium and 1 low, applying vendor updates based on exposure. Pay particular attention to internet-facing Secure Email, FMC, ASA, FTD, Nexus Dashboard, ISE and ThousandEyes assets.

Beyond the patch

Next month, the difference between a manageable Cisco week and a scramble is knowing which network-facing devices are exposed and having detection already running for exploited flaws. Managed Detection & Response (MDR) provides the detection and response layer for actively exploited CVEs, Virtual CISO Services (vCISO) helps map and reduce exposure on internet-facing ISE, Secure Email and firewall management interfaces, and Implementation & Assessment Services gives the penetration testing and hardening work that finds injection, deserialisation and authentication flaws before they show up in a patch cycle.