Cisco Secure Email Gateway / Secure Email and Web Manager, uncontrolled resource consumption grouping, September 2026 hardening release, not reported exploited

CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)

Cisco's own advisory names the mechanism plainly: insufficient validation in the email-parsing logic of AsyncOS lets an unauthenticated remote attacker send a single crafted email containing SQL statements through the device, and "a successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system" (Cisco PSIRT, 2026-09-14). CVE-2026-76461 (CVSS 9.8) affects every Cisco Secure Email Gateway, physical and virtual, regardless of configuration; Cisco confirms Secure Email and Web Manager and Secure Web Appliance are not affected by this specific flaw. There is no workaround; the only remediation is upgrading to AsyncOS 15.5.5-014, 16.0.4-302, or 16.5.0-780, the release Cisco "strongly recommends" migrating to.

Two details in Cisco's own wording raise this above a routine emergency patch. First, Cisco states the vulnerability "was found during the resolution of a Cisco TAC support case" (meaning it surfaced from a real customer's compromise investigation, not internal fuzzing), and that it has already directly contacted Secure Email Cloud customers on whose devices indicators of compromise were found, having upgraded all Cloud instances itself (Cisco PSIRT, 2026-09-14). Second, CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, giving it a three-day remediation deadline (due 2026-09-17) and flagging it for Forensic Triage Requirements (CISA KEV, catalogue version 2026.09.14); NCSC-NL's own advisory relays the same exploitation claim: "Cisco reports that successful exploitation of this vulnerability has been observed" (translated from Dutch) (NCSC-NL, NCSC-2026-0368, 2026-09-14). Because a successful exploit grants root, Cisco itself warns that local log evidence of exploitation may have been removed by the attacker, and recommends cross-checking firewall and network logs external to the appliance rather than relying on the device's own logs alone.

The same day, Cisco shipped a companion "Security Hardening Release" advisory for the identical product line, bundling five further internally-discovered vulnerabilities that Cisco groups by CWE class rather than by individual flaw: a path-traversal grouping (CVE-2026-76440, CVSS 9.8), an improper-access-control grouping (CVE-2026-76441, CVSS 9.8), an uncontrolled-resource-consumption grouping (CVE-2026-20353, CVSS 9.8), a second injection-class grouping (CVE-2026-76443, CVSS 9.8, explicitly distinct from the exploited CVE-2026-76461 despite sharing the same top-level weakness class) and an input-validation grouping (CVE-2026-76442, CVSS 7.5). Cisco's own table states that "the CVSS score that is assigned to each CVE ID represents the maximum potential severity of the single most impactful underlying vulnerability within that specific CWE category," so the four identical 9.8 scores reflect an assigned ceiling per grouping rather than four independently-confirmed critical bugs. Unlike the exploited flaw, this bundle also affects Secure Email and Web Manager, and Cisco states none of the five is known to be exploited or publicly disclosed elsewhere. Notably, Cisco attributes discovery of this bundle to "internal security testing using existing testing processes as well as frontier AI models" (Cisco PSIRT, hardening-release advisory, 2026-09-14). Administrators who upgrade against the exploited CVE close all six CVEs with the same action, since both advisories share identical fixed releases for Secure Email Gateway.