CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability

Analysis on rafaelpfister.ch

Article · October 6, 2026 CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Is Being Exploited—Update and Check for Compromise A specially crafted email is all it takes: via an SQL injection in AsyncOS, attackers can execute commands with root privileges on Cisco Secure Email Gateway (CVE-2026-76461, CVSS 9.8). The vulnerability is being exploited, and no workaround is available. Updating to a fixed version and checking for compromise are required.

Vendor description

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Reference data

Vendor

Cisco

Affected products

Cisco Secure Email

CVSS 3.1

9.8 (CRITICAL)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-89: SQL Injection

Published

September 14, 2026

In KEV catalog since

September 14, 2026

US federal deadline

September 17, 2026

Official sources

← All vulnerabilities