ZeroDayAlert

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Cisco Secure Email Gateway Added to KEV 2026-09-14 Federal due 2026-09-17 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Cisco Secure Email Gateway (SEG) running vulnerable versions of AsyncOS is affected. This is an email security appliance typically deployed at organisational boundaries to filter inbound and outbound mail. The vulnerability allows unauthenticated remote code execution with root privileges, meaning any attacker who can reach the SEG interface does not need valid credentials to compromise it.

How to check whether this touches you

  • Inventory: Search your asset register for Cisco Secure Email Gateway appliances, including any that may be managed by a third party or cloud provider.
  • Network reachability: Confirm whether the SEG administrative or service interfaces are reachable from the internet, or whether they are restricted to internal networks only.
  • Version check: Log into each SEG and note the AsyncOS software version. Version information appears in the system settings or administrative console; this signals exposure but does not prove whether a fix has been backported to your specific build.
  • Deployment scope: If SEGs are cloud-hosted, establish whether you or Cisco controls patching, as remediation responsibility differs.

What to do

  1. Immediate isolation: If you cannot patch within the federal remediation window (17 September 2026), restrict network access to the SEG to only trusted internal networks and block any internet-facing administrative ports.
  2. Patch planning: Contact Cisco support to obtain patched AsyncOS versions and test them in a non-production environment before deployment.
  3. Logging and monitoring: Enable verbose logging on the SEG to capture authentication attempts and SQL queries. Forward logs to a central security information and event management system outside the SEG itself, since a compromised SEG cannot be trusted.
  4. Cloud services: If your SEG is cloud-hosted, contact your provider to confirm their patching timeline and whether they meet BOD 26-04 expectations; if they cannot patch, plan migration to an alternative product.
  5. Escalation: Flag this to your change advisory board and security leadership now, since the remediation deadline is fixed and testing takes time.

If you find you were exposed

The vulnerability allows unauthenticated remote code execution, which typically precedes public disclosure by weeks or months. Review SEG logs and forwarded mail queues for the period six months before the CISA KEV publication date (14 September 2026) for anomalous SQL patterns, administrative access from unexpected source addresses, or system commands executed outside normal operations. Examine backup mail logs and DNS queries from the SEG to detect data exfiltration. Most organisations retain logs for 30–90 days; if yours are shorter, you may not be able to confirm whether exploitation occurred. Assume the worst and conduct forensics on connected internal systems (particularly directory services and credential stores) in parallel.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-76461 is being exploited. It cannot tell you whether Secure Email Gateway is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →