Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-76461

Published 2026-09-14

Updated last month

Vendor/s

Cisco

Product/s

Secure Email Gateway

Version/s

\* > 15.5.5-014

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-76461 is a critical RCE vulnerability in Cisco Secure Email Gateway (CVSS 9.8) being actively exploited via crafted email messages.

## Why this matters

"CVE-2026-76461 is a critical vulnerability (CVSS 9.8) in Cisco Secure Email Gateway that allows unauthenticated remote attackers to gain root-level access. This flaw is particularly significant as it is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming its active use in real-world attacks. By sending a crafted email containing malicious SQL statements, an attacker can bypass security controls to execute arbitrary commands. Given the gateway's role in processing sensitive communications, a successful exploit could lead to full system compromise, data theft, and a foothold for further network penetration. Immediate patching is essential for all affected organizations."

## CPE

Cisco

| Product                                           | Version Start | Version End (excl.) | Status     |
| ------------------------------------------------- | ------------- | ------------------- | ---------- |
| asyncos                                           | \*            | 15.5.5-014          | vulnerable |
| asyncos                                           | 16.0          | 16.0.4-302          | vulnerable |
| asyncos                                           | 16.5          | 16.5.0-780          | vulnerable |
| secure\_email\_gateway\_virtual\_appliance\_c100v | -             | -                   | unaffected |
| secure\_email\_gateway\_virtual\_appliance\_c300v | -             | -                   | unaffected |
| secure\_email\_gateway\_virtual\_appliance\_c600v | -             | -                   | unaffected |
| secure\_email\_gateway\_c195                      | -             | -                   | unaffected |
| secure\_email\_gateway\_c395                      | -             | -                   | unaffected |
| secure\_email\_gateway\_c695                      | -             | -                   | unaffected |

## Related weakness (CWE)

CWE-89

## Remediation plan

1

### Apply official patches

Cisco has released security updates for Cisco AsyncOS Software to address this critical SQL injection vulnerability. Organizations should refer to the Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX for detailed instructions on obtaining and installing the necessary software fixes for their hardware or virtual appliances.

2

### Update affected systems

Update Cisco Secure Email Gateway to AsyncOS versions 15.5.5-014, 16.0.4-302, 16.5.0-780, or later. Systems running versions prior to these releases are vulnerable and should be upgraded immediately to mitigate the risk of remote command execution and system takeover.

3

### Restrict access

Since the vulnerability is exploited via crafted email messages, ensure that only trusted mail servers can relay traffic to the gateway where possible. Additionally, harden the appliance by restricting administrative access (SSH/HTTPS) to internal management networks and implementing multi-factor authentication for all users.

4

### Monitor for exploitation

Monitor system and mail logs for evidence of SQL injection attempts or unusual system commands. In accordance with CISA's BOD 26-04, perform forensics triage to identify potential indicators of compromise, such as unauthorized root-level process execution or unexpected outbound network traffic originating from the gateway.

## Detection Guidance

"Detecting exploitation involves monitoring SMTP traffic for SQL injection patterns, such as 'UNION SELECT' or unexpected semicolons within email headers and bodies. Security teams should analyze Cisco AsyncOS logs for database syntax errors or evidence of shell command execution. Deploying network-based signatures (IDS/IPS) to inspect inbound mail for malicious payloads and auditing root-level system changes are critical for identifying active compromise."

## References

[https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Vendor Advisory ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-76461 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)