CVE-2026-76461
Published on September 14, 2026
Cisco Secure Email Gateway SQL Injection Vulnerability
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Known Exploited Vulnerability
This Cisco Secure Email Gateway SQL Injection Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
The following remediation steps are recommended / required by September 17, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab
Vulnerability Analysis
CVE-2026-76461 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors in an automatable fashion. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2026-76461 has been classified to as a SQL Injection vulnerability or weakness.
Affected Versions
Cisco Secure Email:- Version 14.0.0-698 is affected.
- Version 13.5.1-277 is affected.
- Version 13.0.0-392 is affected.
- Version 14.2.0-620 is affected.
- Version 13.0.5-007 is affected.
- Version 13.5.4-038 is affected.
- Version 14.2.1-020 is affected.
- Version 14.3.0-032 is affected.
- Version 15.0.0-104 is affected.
- Version 15.0.1-030 is affected.
- Version 15.5.0-048 is affected.
- Version 15.5.1-055 is affected.
- Version 15.5.2-018 is affected.
- Version 16.0.0-050 is affected.
- Version 15.0.3-002 is affected.
- Version 16.0.0-054 is affected.
- Version 15.5.3-022 is affected.
- Version 16.0.1-017 is affected.
- Version 15.5.4-012 is affected.
- Version 16.0.4-016 is affected.
- Version 15.0.5-016 is affected.
- Version 16.0.2-112 is affected.
- Version 16.0.3-044 is affected.