CVE-2026-76461

Cisco Secure Email Gateway SQL Injection Vulnerability

CRITICAL

9.8

CVSS Score

Published: September 14, 2026 at 04:09 PM UTC

Updated: September 15, 2026 at 01:00 PM UTC

8 products affected across 1 vendorAsyncosSecure Email Gateway Virtual Appliance C300VSecure Email Gateway C695

Using Cisco Secure Email by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Secure Email - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploitation

CISA KEV

Exploit prediction

EPSS 30%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score29.5%

EPSS (Exploit Prediction Scoring System) estimates a 29.5% chance this CVE is exploited in the wild within the next 30 days — higher than 98% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware Use

Unknown

Added to KEV

Sep 14, 2026

Remediation Due

Sep 17, 2026

45 days overdue

Notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk

https://nvd.nist.gov/vuln/detail/CVE-2026-76461

Description

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Asyncos · Cisco

95%

v < 15.5.5-01416.0 ≤ v < 16.0.4-30216.5 ≤ v < 16.5.0-780

Affected range stops below 15.5.5-014, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.0.4-302, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.5.0-780, so it looks safe — our inference, not a vendor statement

cisco-secure-email-gateway-c195 (environment) · cisco-secure-email-gateway-c395 (environment) · cisco-secure-email-gateway-c695 (environment) · cisco-secure-email-gateway-virtual-appliance-c100v (environment) · cisco-secure-email-gateway-virtual-appliance-c300v (environment) · cisco-secure-email-gateway-virtual-appliance-c600v (environment)