CVE Details

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability
Published: 2026-09-14 CVSS: 9.8 CRITICAL Product: Cisco Secure Email Gateway Due Date: 2026-09-17

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.8
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-76461
cveMetadata > assignerOrgId d1c1063e-7a18-46af-9102-31f8928bc633
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName cisco
cveMetadata > dateReserved 2026-08-19T12:02:03.637Z
cveMetadata > datePublished 2026-09-14T16:09:07.839Z
cveMetadata > dateUpdated 2026-09-14T19:43:19.204Z
containers > cna > title Cisco Secure Email Gateway SQL Injection Vulnerability
containers > cna > metrics > 0 > format cvssV3_1
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > baseScore 9.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
containers > cna > references > 0 > url https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
containers > cna > references > 0 > name cisco-sa-esa-inj-2bLVGmhX
containers > cna > exploits > 0 > lang en
containers > cna > exploits > 0 > value In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
containers > cna > source > advisory cisco-sa-esa-inj-2bLVGmhX
containers > cna > source > discovery INTERNAL
containers > cna > source > defects > 0 CSCwu56234
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
containers > cna > problemTypes > 0 > descriptions > 0 > type cwe
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-89
containers > cna > affected > 0 > vendor Cisco
containers > cna > affected > 0 > product Cisco Secure Email
containers > cna > affected > 0 > versions > 0 > version 14.0.0-698
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 1 > version 13.5.1-277
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 2 > version 13.0.0-392
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 3 > version 14.2.0-620
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 4 > version 13.0.5-007
containers > cna > affected > 0 > versions > 4 > status affected
containers > cna > affected > 0 > versions > 5 > version 13.5.4-038
containers > cna > affected > 0 > versions > 5 > status affected
containers > cna > affected > 0 > versions > 6 > version 14.2.1-020
containers > cna > affected > 0 > versions > 6 > status affected
containers > cna > affected > 0 > versions > 7 > version 14.3.0-032
containers > cna > affected > 0 > versions > 7 > status affected
containers > cna > affected > 0 > versions > 8 > version 15.0.0-104
containers > cna > affected > 0 > versions > 8 > status affected
containers > cna > affected > 0 > versions > 9 > version 15.0.1-030
containers > cna > affected > 0 > versions > 9 > status affected
containers > cna > affected > 0 > versions > 10 > version 15.5.0-048
containers > cna > affected > 0 > versions > 10 > status affected
containers > cna > affected > 0 > versions > 11 > version 15.5.1-055
containers > cna > affected > 0 > versions > 11 > status affected
containers > cna > affected > 0 > versions > 12 > version 15.5.2-018
containers > cna > affected > 0 > versions > 12 > status affected
containers > cna > affected > 0 > versions > 13 > version 16.0.0-050
containers > cna > affected > 0 > versions > 13 > status affected
containers > cna > affected > 0 > versions > 14 > version 15.0.3-002
containers > cna > affected > 0 > versions > 14 > status affected
containers > cna > affected > 0 > versions > 15 > version 16.0.0-054
containers > cna > affected > 0 > versions > 15 > status affected
containers > cna > affected > 0 > versions > 16 > version 15.5.3-022
containers > cna > affected > 0 > versions > 16 > status affected
containers > cna > affected > 0 > versions > 17 > version 16.0.1-017
containers > cna > affected > 0 > versions > 17 > status affected
containers > cna > affected > 0 > versions > 18 > version 15.5.4-012
containers > cna > affected > 0 > versions > 18 > status affected
containers > cna > affected > 0 > versions > 19 > version 16.0.4-016
containers > cna > affected > 0 > versions > 19 > status affected
containers > cna > affected > 0 > versions > 20 > version 15.0.5-016
containers > cna > affected > 0 > versions > 20 > status affected
containers > cna > affected > 0 > versions > 21 > version 16.0.2-112
containers > cna > affected > 0 > versions > 21 > status affected
containers > cna > affected > 0 > versions > 22 > version 16.0.3-044
containers > cna > affected > 0 > versions > 22 > status affected
containers > cna > affected > 0 > defaultStatus unknown
containers > cna > providerMetadata > orgId d1c1063e-7a18-46af-9102-31f8928bc633
containers > cna > providerMetadata > shortName cisco
containers > cna > providerMetadata > dateUpdated 2026-09-14T16:09:07.839Z
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-76461
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-14T19:40:04.523220Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-14T19:43:19.204Z