CVE-2026-76461: Cisco Secure Email Gateway SQL Injection to Root RCE (KEV)

CVE-2026-76461 is a SQL injection in the email-parsing logic of Cisco AsyncOS for Secure Email Gateway that lets a remote, unauthenticated attacker email a device malicious SQL statements that lead to arbitrary command execution with root privileges on the underlying operating system, and Cisco PSIRT confirmed active exploitation of this flaw in September 2026.

CVE-2026-76461 is a SQL injection vulnerability (CWE-89) in Cisco AsyncOS Software for Cisco Secure Email Gateway. Cisco's advisory states: "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system" (Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX).

NVD's record for this CVE is Analyzed, but the only CVSS metric on file is the reporting Cisco PSIRT's own Secondary rating of CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; NVD has not published an independent Primary score, so the 9.8 shown here is Cisco's own CNA Secondary score, not an NVD-confirmed figure (NVD).

Cisco's advisory lists the fix as AsyncOS 15.5.5-014 for the 15.5-and-earlier branch, 16.0.4-302 for the 16.0 branch, and 16.5.0-780 for the 16.5 branch, affecting both physical (C195, C395, C695) and virtual (C100v, C300v, C600v) Secure Email Gateway appliances. Cisco states plainly: "There are no workarounds that address this vulnerability." For detection, Cisco advises administrators to search mail logs for patterns such as "COPY.*TO PROGRAM" that indicate attempted exploitation, and confirms: "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability" (Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX).

CISA added CVE-2026-76461 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-14, with a required-action due date of 2026-09-17, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.2954 (98.2nd percentile), consistent with Cisco's own confirmation of in-the-wild attacks against an email-facing, internet-reachable appliance class (FIRST EPSS).

Because the attack vector is simply an inbound email and there is no workaround, any Cisco Secure Email Gateway on an affected AsyncOS version should be upgraded to the fixed release for its branch immediately, and administrators should review mail logs for the SQL-injection patterns Cisco describes to check for prior exploitation.

• Insufficient validation in AsyncOS email-parsing logic lets an unauthenticated remote attacker send a crafted email with malicious SQL statements, leading to command execution with root privileges on the underlying OS. — Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX
• NVD vulnStatus is Analyzed; the only CVSS metric is the Cisco PSIRT's Secondary CVSS v3.1 score of 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD Primary score published. — NVD
• No workarounds exist; fixed in AsyncOS 15.5.5-014, 16.0.4-302 and 16.5.0-780, affecting C195/C395/C695 hardware and C100v/C300v/C600v virtual appliances; Cisco PSIRT became aware of active exploitation in September 2026. — Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-14, required-action due date 2026-09-17, ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.2954 (98.2nd percentile) as of 2026-10-28. — FIRST EPSS