← back
CVE-2026-76461criticalunder attackCWE-89

Cisco Secure Email Gateway SQL Injection Vulnerability

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 2.0%
from disclosure to weapon1 days
Published on NVDSep 14
1st PoC+1d
CISA KEVSep 14
exploitation probability
2.0%top 20% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2026-09-17

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in Cisco Secure Email Gateway allows attackers to send specially crafted emails that bypass security checks and execute dangerous commands with the highest system privileges. This can completely compromise the email server and any data it handles.

Technical detail

SQL injection vulnerability in AsyncOS email parsing logic due to insufficient input validation. Unauthenticated remote attacker can send malicious SQL-encoded email to execute arbitrary SQL statements, achieving OS command execution with root privileges on the underlying system.

Summary generated and translated by AI from the official description.
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Secure Email
public PoCs found — 4
githubgithub.com/0xBlackash/CVE-2026-76461★ 2githubgithub.com/S3v3n-JG/CVE-2026-76461★ 1githubgithub.com/HORKimhab/CVE-2026-76461★ 0githubgithub.com/fevar54/CVE-2026-76461-Detection-Kit-★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhXhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461