🔐 CVE Alert

CVE-2026-76461

CRITICAL 9.8 ⚠️ CISA KEV

Cisco Secure Email Gateway SQL Injection Vulnerability

CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

CWE CWE-89
Vendor cisco
Product cisco secure email
Ecosystems
Industries
NetworkingTelecommunications
Published Sep 14, 2026
Last Updated Sep 15, 2026
⚠️ Actively Exploited — Act Now

Get instant alerts for cisco cisco secure email

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-76461.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

Cisco / Cisco Secure Email
14.0.0-698 13.5.1-277 13.0.0-392 14.2.0-620 13.0.5-007 13.5.4-038 14.2.1-020 14.3.0-032 15.0.0-104 15.0.1-030 15.5.0-048 15.5.1-055 15.5.2-018 16.0.0-050 15.0.3-002 16.0.0-054 15.5.3-022 16.0.1-017 15.5.4-012 16.0.4-016 15.0.5-016 16.0.2-112 16.0.3-044

References

NVD ↗ CVE.org ↗ EPSS Data ↗
sec.cloudapps.cisco.com: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461