Skip to content
Sign in
CVE-2026-764619.8CriticalCWE-89

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco · Secure Email Gateway

Exploited in the wild · in CISA KEV since 14 Sep
29.5%probability of exploitation in the next 30 days
98th percentile
050100

Higher than 98% of scored CVEs

9.8CriticalCVSS 3.1
LowCrit.

Federal deadline

CISA KEV · added 14 Sep · catalogue entry

Passed 42 days ago

DescriptionNVD

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage10 articles · 7 outlets

One row per outlet, in order of first report. First in our coverage: CISA, 14 Sep.

Full timeline
Quiet for 2 weekslast report 15 Oct10 articles7 outlets
14 Sep · CISA first1 Oct9 Oct17 OctNow
  • Mon 14 Sep, 20:32 UTC. CISA, first report. CISA Warns of Actively Exploited Cisco Email Gateway Flaw. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 04:41 UTC. SecurityOnline, its first report on the story. Cisco Email Gateway Flaw Exploited to Gain Root Access via Email. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 05:52 UTC. SecurityWeek, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Rapid7, its first report on the story. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 21:21 UTC. Security Affairs. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:51 UTC. SOCRadar, its first report on the story. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 19:26 UTC. The Hacker News, its first report on the story. Cisco Email Gateway Flaw Exploited to Run Commands as Root. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 07:01 UTC. SecurityWeek. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access. Cites a CVE in CISA KEV.
All coveragerunning total10CISA1SecurityOnl…2SecurityWeek2Security Af…2Rapid71SOCRadar1The Hacker…115 Sep1 Oct17 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
10 articles about CVE-2026-76461 from 7 outlets
Published (UTC)OutletHeadline
14 Sep 20:32CISACISA Warns of Actively Exploited Cisco Email Gateway Flaw
15 Sep 04:41SecurityOnlineCisco Email Gateway Flaw Exploited to Gain Root Access via Email
15 Sep 05:52SecurityWeekCisco Secure Email Gateways Hit by Actively Exploited Root Flaw
15 Sep 13:13Security AffairsCisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day
15 Sep 13:13Rapid7Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely
15 Sep 21:21Security AffairsCISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks
16 Sep 14:51SOCRadarCisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw
21 Sep 02:59SecurityOnlineCisco Warns of Actively Exploited Flaws Enabling Root Access
14 Oct 19:26The Hacker NewsCisco Email Gateway Flaw Exploited to Run Commands as Root
15 Oct 07:01SecurityWeekAttackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access
  1. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access
    SecurityWeek · mentions it in passing
  2. Cisco Email Gateway Flaw Exploited to Run Commands as Root
    The Hacker News · mentions it in passing
  3. Cisco Warns of Actively Exploited Flaws Enabling Root Access
    SecurityOnline · mentions it in passing
  4. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw
    SOCRadar
  5. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks
    Security Affairs
  6. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely
    Rapid7
  7. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day
    Security Affairs
  8. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw
    SecurityWeek
Show 2 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in