DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-76461: CVE-2026-76461: SQL Injection to Remote Code Execution in Cisco Secure Email Gateway

#security #cve #cybersecurity

CVE-2026-76461: SQL Injection to Remote Code Execution in Cisco Secure Email Gateway

Vulnerability ID: CVE-2026-76461
CVSS Score: 9.8
Published: 2026-09-14

CVE-2026-76461 is a critical, unauthenticated, remotely exploitable SQL Injection (SQLi) vulnerability in the email parsing engine of Cisco AsyncOS Software for Cisco Secure Email Gateway (SEG). An unauthenticated remote attacker can exploit this vulnerability by transmitting a specially crafted email message containing malicious SQL statements directly through an affected gateway.

TL;DR

An unauthenticated remote SQL injection vulnerability in Cisco Secure Email Gateway allows attackers to execute arbitrary system commands as root via crafted SMTP traffic.

⚠️ Exploit Status: ACTIVE

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network
  • CVSS Score: 9.8 (Critical)
  • CISA KEV Status: Listed (September 14, 2026)
  • Exploit Status: Active exploitation in the wild
  • Platform: Cisco AsyncOS (FreeBSD-based)

Affected Systems

  • Cisco Secure Email Gateway (Physical Hardware Appliances: C170, C195, C380, C390, C395, C680, C690, C690X, C695)
  • Cisco Secure Email Gateway Virtual (C100V, C300V, C600V)
  • Cisco Content Security Management Appliance (M170)
  • AsyncOS Software for Cisco Secure Email Gateway: < 15.5.5-014 (Fixed in: 15.5.5-014)
  • AsyncOS Software for Cisco Secure Email Gateway: 16.0.0 to < 16.0.4-302 (Fixed in: 16.0.4-302)
  • AsyncOS Software for Cisco Secure Email Gateway: 16.5.0 < 16.5.0-780 (Fixed in: 16.5.0-780)

Mitigation Strategies

  • Apply official Cisco AsyncOS Software updates immediately.
  • Redeploy virtual appliances from clean, patched images if compromise is suspected.
  • Rotate all administrative credentials, API tokens, and SSH keys post-upgrade.

Remediation Steps:

  1. Verify the current running version of Cisco AsyncOS via the CLI command 'version' or the administrative Web UI.
  2. Download and install the appropriate patched release (15.5.5-014, 16.0.4-302, or 16.5.0-780) from the Cisco Software Central portal.
  3. Reboot the appliance to finalize the installation of the security patch.
  4. Audit the system logs using 'grep -i "COPY.*TO PROGRAM" [mail_logs]' to identify potential historic indicators of compromise.

References

Read the full report for CVE-2026-76461 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)