Cisco Secure Email Gateway SQL Injection Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Security Impact Rating: Critical CVE: CVE-2026-76461
Details
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-76461Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-76461 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highexploited[NEU] [hoch] Cisco Secure Email Gateway: Mehrere Schwachstellencert-bund
- unknownexploitedCisco Products Multiple Vulnerabilitieshkcert
- unknownexploitedMultiples vulnérabilités dans les produits Cisco (15 septembre 2026)cert-fr-avis
- unknownexploitedCisco security advisory (AV26-921)cccs
- unknownexploitedNCSC-2026-0368 [1.00] [H/H] Kwetsbaarheid verholpen in Cisco Secure Email Gatewayncsc-nl
- criticalexploitedCVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway …nvd
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
- criticalexploitedCVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerabilitycisa-kev
Recent advisories for Cisco Secure Email
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highexploited[NEU] [hoch] Cisco Secure Email Gateway: Mehrere Schwachstellencert-bund · 2026-09-15
- unknownexploitedNCSC-2026-0368 [1.00] [H/H] Kwetsbaarheid verholpen in Cisco Secure Email Gatewayncsc-nl · 2026-09-14
- criticalexploitedCVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway …nvd · 2026-09-14
- criticalCVE-2026-76443: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Sec…nvd · 2026-09-14
- highCVE-2026-76442: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Sec…nvd · 2026-09-14
- criticalCVE-2026-76441: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Sec…nvd · 2026-09-14
More from Cisco Security Advisories
- criticalCisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 20262026-09-14
- criticalCisco IOS XR Software Security Hardening Release: September 20262026-09-11
- criticalCisco Secure Firewall Management Center Software Authentication Bypass Vulnerability2026-09-09
- unknownCisco Advance Notification for Publication of September 16, 2026, Security Advisories2026-09-09
- highCisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability2026-09-08