Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Cisco Secure Email Gateway lets remote attacker run commands

CVE-2026-76461 · published 28 days ago · actively exploited
Summary

The Cisco Secure Email Gateway software called AsyncOS can be tricked into running harmful commands without any login. This means a stranger on the internet could take control of the system that handles your email traffic. Apply the latest security update from Cisco as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco cisco secure email 14.0.0-698
cisco secure email gateway All versions
cisco asyncos < 15.5.5-014
>= 16.0, < 16.0.4-302
>= 16.5, < 16.5.0-780
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
Original advisory text
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 3 days
and check for signs of compromise
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
28% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published14 Sep 2026
Updated9 Oct 2026
First seen14 Sep 2026
Sources
CVE-2026-76461 · NVD
CVE-2026-76461 · MITRE
CVE-2026-76461 · CISA KEV
Track software like this
Free during beta