Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-76461 9.8
Cisco · Secure Email Gateway · Added 2026-09-14 · Published 2026-09-14
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCisco Secure Email Gateway SQL Injection Vulnerability
VendorCisco
ProductSecure Email Gateway
Date added2026-09-14
Due date2026-09-17
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-89
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

NVD: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-09-14 20:10 UTC
Wall time0.5s
Searches1
Component defaultyes
Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
https://nvd.nist.gov/vuln/detail/CVE-2026-76461
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX/csaf/cisco-sa-esa-inj-2bLVGmhX.json
https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-5/user_guide/b_ESA_Admin_Guide_16-5.html
https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-5/user_guide/b_sma_admin_guide_16_5.html

Hunting hypothesis agent

Hunt mail_logs for entries matching 'COPY.*TO PROGRAM' or similar SQL execution patterns; review network and firewall logs for unexpected outbound connections from the ESA to external IPs indicating post-exploitation command execution.

Research details

Componentemail parsing logic in Cisco AsyncOS Software
PreconditionsAttacker must be able to send an email message to the affected Cisco Secure Email Gateway device; the device must be running a vulnerable version of Cisco AsyncOS Software (15.5 and earlier, 16.0, or 16.5 before fixed releases); no authentication is required; device configuration does not affect vulnerability agent
Deliverycrafted email message with malicious SQL statements
Public PoCno
Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8) | Cisco PSIRT confirmed active exploitation in September 2026 | No public PoC available | The SQL injection is triggered via crafted email content, making exploitation straightforward for an attacker who can deliver email to the device
SummaryCisco Secure Email Gateway contains a SQL injection vulnerability in the AsyncOS email parsing logic that allows an unauthenticated remote attacker to execute arbitrary commands with root privileges via crafted email messages. Cisco PSIRT confirmed active exploitation in September 2026; no workarounds exist, only patched AsyncOS releases.

Tia coverage

First reported2026-09-09
First exploit report2026-09-14
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

a-newly-kev-listed-cisco-ise-bug-lets-an-unauthenticated-attackecisco-has-addressed-a-critical-september-2-vulnerability-criticacisco-patches-critical-zero-day-in-secure-email-gateway-cve-2026spain-s-data-protection-authority-first-cyberattack-using-an-ai

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub