Vulnerabilities
CVE-2026-76461 — Cisco Secure Email Gateway SQL Injection Vulnerability
CVE-2026-76461 · Cisco Secure Email · CVSS 9.8 · KEV
In brief
- Severity · CVSS
- Critical9.8CVSS 3.1, Critical
- EPSS
- 28%
- CISA KEV
- Known exploited, listed since 14 Sept 2026
- CERT-FR
- CERTFR-2026-AVI-1175
- Vendor
- Cisco
- Published · Modified
- ·
- Last verified
Summary
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Weakness: CWE-89
Title, description and the vendor's statements are quoted from the CVE record; a vendor's advisory is summarised in Patcharo's words, with a link.
Affected and fixed versions
Per product and release branch, as the vendor's CVE record and official advisory state them. A fixed release is shown only when a document names it: the vendor's, or CERT-FR's for Check Point, with its source.
9 branches with a published fixed release
Cisco Secure Email
- 16.5Affected versions< 16.5.0-780First fixed release16.5.0-780
- 16.0Affected versionsListed as affected, releases not specifiedFirst fixed release16.0.4-302
- 15.5Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
- 15.0Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
- 14.3Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
- 14.2Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
- 14.0Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
- 13.5Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
- 13.0Affected versionsListed as affected, releases not specifiedFirst fixed release15.5.5-014
Remediation
Fix available
Vendor fix
- Secure Email 16.516.5.0-780
- Secure Email 16.016.0.4-302
- Secure Email 15.515.5.5-014
- Secure Email 15.015.5.5-014
- Secure Email 14.315.5.5-014
- Secure Email 14.215.5.5-014
- Secure Email 14.015.5.5-014
- Secure Email 13.515.5.5-014
- Secure Email 13.015.5.5-014
Upgrade to a fixed release listed above for your branch, or to a later fixed release the vendor explicitly supports.
Cisco has released updates that fix this vulnerability; its advisory lists them.
Workarounds (vendor)
Cisco states in its advisory that no workaround is available.
CISA KEV required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
Full CISA action
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date:
SourceCISA KEV
CERT-FR recommendation
Refer to the vendor's security bulletin to obtain patches (see Documentation section).
SourceCERTFR-2026-AVI-1175
Last verified 1 Oct 2026 at 09:31 UTC
Known exploitation
Added to CISA KEV on 14 Sept 2026
Federal remediation due date: 17 Sept 2026
28% probability of exploitation in the next 30 days (percentile 98%).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CERT-FR
1 document of the French national CERT (ANSSI) references this CVE.
Multiple vulnerabilities in Cisco products
Remote denial of serviceRemote cross-site scripting (XSS)Remote arbitrary code executionSQL injection (SQLi)Security policy bypass
Summary
Multiple vulnerabilities have been discovered in Cisco products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service, and SQL injection (SQLi). Cisco indicates that vulnerability CVE-2026-76461 is being actively exploited. Cisco recommends searching for suspicious SQL queries in the *mail_logs* logs. To this end, the vendor provides a non-exhaustive example of a command: cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]
Recommendation
Refer to the vendor's security bulletin to obtain patches (see Documentation section).
Official document on cert.ssi.gouv.frread by Patcharo 28 Sept 2026 at 20:03 UTCMachine translation of the French text published by CERT-FR; a text whose translation did not pass Patcharo's checks stays in French. Identifiers, versions and links are copied unchanged.
Timeline
- Added to CISA KEV
- Published by the source
- CISA remediation due date
- Source record last modified
- EPSS score computed
- Last verified by Patcharo
Official sources
- Cisco (CVE record)retrieved 1 Oct 2026 at 09:31 UTC
- CISA Known Exploited Vulnerabilitiesretrieved 1 Oct 2026 at 09:28 UTC
- NVDretrieved 28 Sept 2026 at 07:02 UTC
- FIRST EPSSretrieved 30 Sept 2026 at 00:17 UTC
- Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhXretrieved 1 Oct 2026 at 09:31 UTC
References
Cisco · CISA Known Exploited Vulnerabilities · NVD · FIRST EPSS · Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX
How Patcharo reads this
Affected and fixed releases come from the vendor's structured statements and are matched against exact versions; CVSS from NVD, exploitation from CISA KEV and the vendor's own advisory, probability from FIRST EPSS. Missing data stays Unknown and never becomes Not affected.
Read the methodologyRead the guide: Cisco Secure Firewall release trains: Threat Defense, Management Center and ASA versions explained