CVE-2026-76461

Cisco Secure Email Gateway SQL Injection Vulnerability

Published Sep 14, 2026 CVSS 3.1 · 9.8 Critical EPSS 40.2% KEV · Listed

Description

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Analysis

Technical impact

The flaw resides in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway. The parser does not properly validate or sanitize certain email fields, allowing a crafted message to contain malicious SQL statements. When processed, these statements are executed, giving an attacker the ability to run arbitrary commands with root privileges on the operating system that hosts the gateway.

Affected Systems

Cisco Secure Email Gateway, specifically the Cisco AsyncOS Software component. No specific version information is provided in the advisory, so all deployments of the gateway are potentially affected until patched.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity, and the vulnerability is listed in the CISA KEV catalog, underscoring its exploitation potential. The EPSS score of 40% suggests a significant likelihood that attackers will exploit this flaw. The attack vector is malicious email to the gateway. Successful exploitation would grant the attacker full control with root rights, potentially affecting confidentiality, integrity, and availability of the protected network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Secure Email

unknown

Version	Status	Constraints
`14.0.0-698`	affected	—
`13.5.1-277`	affected	—
`13.0.0-392`	affected	—
`14.2.0-620`	affected	—
`13.0.5-007`	affected	—
`13.5.4-038`	affected	—
`14.2.1-020`	affected	—
`14.3.0-032`	affected	—
`15.0.0-104`	affected	—
`15.0.1-030`	affected	—
`15.5.0-048`	affected	—
`15.5.1-055`	affected	—
`15.5.2-018`	affected	—
`16.0.0-050`	affected	—
`15.0.3-002`	affected	—
`16.0.0-054`	affected	—
`15.5.3-022`	affected	—
`16.0.1-017`	affected	—
`15.5.4-012`	affected	—
`16.0.4-016`	affected	—
`15.0.5-016`	affected	—
`16.0.2-112`	affected	—
`16.0.3-044`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:cisco:asyncos::::::::
	cpe:2.3:o:cisco:asyncos::::::::
	cpe:2.3:o:cisco:asyncos::::::::

OR	cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:::::::*
	cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:::::::*
	cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:::::::*
	cpe:2.3:h:cisco:secure_email_gateway_c195:-:::::::*
	cpe:2.3:h:cisco:secure_email_gateway_c395:-:::::::*
	cpe:2.3:h:cisco:secure_email_gateway_c695:-:::::::*

No data.

Vendor Product Versions

Cisco

Secure Email

Version	Status	Scheme	Platform
`14.0.0-698`	affected	semver	—
`13.5.1-277`	affected	semver	—
`13.0.0-392`	affected	semver	—
`14.2.0-620`	affected	semver	—
`13.0.5-007`	affected	semver	—
`13.5.4-038`	affected	semver	—
`14.2.1-020`	affected	semver	—
`14.3.0-032`	affected	semver	—
`15.0.0-104`	affected	semver	—
`15.0.1-030`	affected	semver	—
`15.5.0-048`	affected	semver	—
`15.5.1-055`	affected	semver	—
`15.5.2-018`	affected	semver	—
`16.0.0-050`	affected	semver	—
`15.0.3-002`	affected	semver	—
`16.0.0-054`	affected	semver	—
`15.5.3-022`	affected	semver	—
`16.0.1-017`	affected	semver	—
`15.5.4-012`	affected	semver	—
`16.0.4-016`	affected	semver	—
`15.0.5-016`	affected	semver	—
`16.0.2-112`	affected	semver	—
`16.0.3-044`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply Cisco’s latest Secure Email Gateway patch or firmware update that addresses the SQL injection flaw
Upgrade the Cisco AsyncOS Software to the newest supported version to eliminate the vulnerability
Limit inbound email traffic to approved, trusted sources or enforce firewall rules to reduce exposure to malicious mail

Generated by OpenCVE AI on November 6, 2026 at 15:54 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Sept. 14, 2026.

Exploit prediction score: 40.2% (40.160% probability within 30 days)

Exploitation active

Automatable yes

Technical Impact total

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461

History

Sep 17, 2026 9:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cisco secure Email
Vendors & Products		Cisco secure Email

Sep 15, 2026 1:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco asyncos Cisco secure Email Gateway C195 Cisco secure Email Gateway C395 Cisco secure Email Gateway C695 Cisco secure Email Gateway Virtual Appliance C100v Cisco secure Email Gateway Virtual Appliance C300v Cisco secure Email Gateway Virtual Appliance C600v
CPEs		cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:::::::* cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:::::::* cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:::::::* cpe:2.3:h:cisco:secure_email_gateway_c195:-:::::::* cpe:2.3:h:cisco:secure_email_gateway_c395:-:::::::* cpe:2.3:h:cisco:secure_email_gateway_c695:-:::::::* cpe:2.3:o:cisco:asyncos::::::::
Vendors & Products		Cisco Cisco asyncos Cisco secure Email Gateway C195 Cisco secure Email Gateway C395 Cisco secure Email Gateway C695 Cisco secure Email Gateway Virtual Appliance C100v Cisco secure Email Gateway Virtual Appliance C300v Cisco secure Email Gateway Virtual Appliance C600v

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Title		Cisco Secure Email Gateway SQL Injection Vulnerability
Weaknesses		CWE-89
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` kev `{'dateAdded': '2026-09-14T00:00:00+00:00', 'dueDate': '2026-09-17T00:00:00+00:00'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Cisco Asyncos Secure Email Secure Email Gateway C195 Secure Email Gateway C395 Secure Email Gateway C695 Secure Email Gateway Virtual Appliance C100v Secure Email Gateway Virtual Appliance C300v Secure Email Gateway Virtual Appliance C600v

Weaknesses