Cisco Releases Security Advisory for Critical SQL Injection Vulnerability in Secure Email Gateway

Successful exploitation of CVE-2026-76461 could allow an unauthenticated remote attacker to obtain root-level command execution on affected gateways

Threat ID:: CC-4851
Threat Severity:: Medium
Published:: 15 September 2026 2:15 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-76461 could allow an unauthenticated remote attacker to obtain root-level command execution on affected gateways

Affected platforms

The following platforms are known to be affected:

Cisco AsyncOS Software for Cisco Secure Email Gateway

All prior to 15.5.5-014
All prior to 16.0.4-302
All prior to 16.5.0-780

Note: This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration.

Threat details

Exploitation of CVE-2026-76461

Cisco has reported exploitation of CVE-2026-76461. The vulnerability has also been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.

The NHS England National CSOC assesses further exploitation as likely.

Introduction

Cisco has released a security advisory to address a critical vulnerability in Cisco Secure Email Gateway. Successful exploitation of CVE-2026-76461 could allow an unauthenticated remote attacker to obtain root-level command execution on affected gateways.

CVE-2026-76461 - SQL Injection vulnerability - CVSS v3.1 Base Score of 9.8

Remediation advice

Affected organisations are encouraged to review the Cisco advisory Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX) and apply the relevant update as soon as possible.

Organisations are also encouraged to review the Cisco advisory Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 and take appropriate action.

Definitive source of threat updates

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

CVE Vulnerabilities

Status Published

CVE-2026-76461

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Last edited: 15 September 2026 2:16 pm