Unauthenticated SQL injection via crafted email gives root command execution on Cisco Secure Email Gateway (CVE-2026-76461)
Cisco published the advisory and CISA added the CVE to KEV on 2026-09-14 with a 2026-09-17 remediation deadline; any Secure Email Gateway that keeps accepting mail on a vulnerable AsyncOS release can be rooted by a single inbound message with no credentials.
Insufficient validation in the email parsing logic of Cisco AsyncOS for Secure Email Gateway lets an unauthenticated remote attacker send a crafted email containing SQL statements through the appliance and turn that into arbitrary command execution as root on the underlying OS. Physical and virtual appliances are affected regardless of configuration, and Cisco has no workaround.
Affected: Cisco AsyncOS for Cisco Secure Email Gateway prior to 15.5.5-014; Cisco AsyncOS for Cisco Secure Email Gateway prior to 16.0.4-302; Cisco AsyncOS for Cisco Secure Email Gateway prior to 16.5.0-780; Cisco Secure Email 13.0.0-392, 13.0.5-007, 13.5.1-277, 13.5.4-038, 14.0.0-698, 14.2.0-620, 14.2.1-020, 14.3.0-032, 15.0.0-104, 15.0.1-030
How to Test
Check the AsyncOS release on each Secure Email Gateway (physical or virtual) via the appliance's version display; anything below 15.5.5-014, 16.0.4-302 or 16.5.0-780, including the 13.x/14.x/15.0.x builds listed above, is vulnerable regardless of configuration. Secure Email and Web Manager is confirmed not affected. Because exploitation arrives as an inbound email, review mail and system logs on the appliance for unexpected commands, new processes or persistence artifacts, and treat any appliance that was exposed to internet mail on a vulnerable release as potentially compromised pending review.
How to Patch
Upgrade Cisco AsyncOS for Secure Email Gateway to 15.5.5-014, 16.0.4-302 or 16.5.0-780 (or later) as appropriate for your release train. Cisco states there are no workarounds for this vulnerability, so the upgrade is the only remediation.