CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) enables unauthenticated root command execution via crafted email; CISA added it to KEV.
CVE-2026-76461 is a critical SQL injection (CVSS 9.8) in Cisco AsyncOS for Secure Email Gateway allowing an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a specially crafted email through a vulnerable gateway. CISA added it to the KEV catalog on disclosure day, indicating zero-day exploitation, and Cisco PSIRT became aware of active exploitation in September 2026. No public PoC or attribution exists; fixed versions are 15.5.5-014, 16.0.4-302, and 16.5.0-780, and admins should check mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM'.
- Exploitation requires no authentication, only email delivery through gateway
- Added to CISA KEV on vendor disclosure day as a zero-day
- Emergency patching recommended outside normal patch cycles
- No public PoC and no threat actor attribution yet
- CVEs
- CVE-2026-76461
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at rapid7.com
Overview On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3. 1 base score of 9.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.