CVE-2026-76461CiscoServers and softwareSeptember 17, 2026

Cisco Secure Email Gateway SQL Injection Vulnerability

Critical 9.8Actively exploited

Description

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Security Impact Rating: Critical CVE: CVE-2026-76461

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Running Cisco devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Cisco alerts

Details

Vendor
Cisco
Product
Cisco Secure Email Gateway
CVE
CVE-2026-76461
Affected versions
Cisco Secure Email 14.0: 14.0.0-698
Cisco Secure Email 13.5: 13.5.1-277; 13.5.4-038
Cisco Secure Email 13.0: 13.0.0-392; 13.0.5-007
Cisco Secure Email 14.2: 14.2.0-620; 14.2.1-020
Cisco Secure Email 14.3: 14.3.0-032
Cisco Secure Email 15.0: 4 versions, from 15.0.0-104 to 15.0.5-016
Cisco Secure Email 15.5: 5 versions, from 15.5.0-048 to 15.5.4-012
Cisco Secure Email 16.0: 6 versions, from 16.0.0-050 to 16.0.4-016 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
9.8
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
Source
Cisco PSIRT – original advisory
Published
September 17, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Cisco advisories