Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-76461 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-14 |
| Vendor | Cisco |
| Product | Secure Email Gateway |
| CVSS Score | 9.8 (critical) |
| EPSS Score | 2.0% (percentile: 80%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-17 |
Vulnerability Description
Source: CISA KEV
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability.
The impact reaches past the database itself: the flaw allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This is not about reading or altering records — it is full device takeover.
The product’s role raises the stakes. A Secure Email Gateway sits on the organisation’s boundary with the outside world and accepts internet traffic by design — that is its job. It also has visibility into the correspondence passing through the organisation, so its compromise touches both availability and the confidentiality of communications.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-17 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running Cisco Secure Email Gateway with AsyncOS — both hardware and virtual deployments (the CPE entry covers the C100V, C300V and C600V appliances).
Because the impact is root-level access, patching alone may not be sufficient. If the appliance was internet-reachable before the fix was applied, treat it as potentially compromised and run a post-intrusion review — CISA points to its own “Forensics Triage Requirements” here.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
