CVE-2026-76461criticalunder attackCWE-89

CVE-2026-76461: critical vulnerability in Cisco Secure Email

Cisco Secure Email Gateway SQL Injection Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco Secure Email+ Monitor Secure Email Gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.8epss 40%
from disclosure to weapon1 day
Published on NVDSep 14
1st PoC+1d
metasploitSep 14
CISA KEVSep 14
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 88/2026 · 28 Sep 2026Vulnerabilidade crítica que afeta produto CISCO - Secure Email Gatewayread on gov.br ↗
  • CISC Gov.br · 24 Sep 2026Boletim do CISC de Vulnerabilidadesread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-09-17

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in Cisco Secure Email Gateway allows attackers to send specially crafted emails that bypass security checks and execute dangerous commands with the highest system privileges. This can completely compromise the email server and any data it handles.

Technical detail

SQL injection vulnerability in AsyncOS email parsing logic due to insufficient input validation. Unauthenticated remote attacker can send malicious SQL-encoded email to execute arbitrary SQL statements, achieving OS command execution with root privileges on the underlying system.

Summary generated and translated by AI from the official description.
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Secure Email
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Secure Email

In the same product, most dangerous first.

CVE-2025-20393CRITICALCisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityEPSS 32.4%KEVCVE-2026-76519CRITICALCisco Secure Email Gateway Arbitrary File Write VulnerabilityEPSS 6.2%KEVCVE-2026-76443CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 2.4%CVE-2024-20401CRITICALCVE-2024-20401EPSS 2.3%CVE-2023-20009MEDIUMCVE-2023-20009EPSS 2.2%CVE-2022-20942MEDIUMCVE-2022-20942EPSS 1.1%