Cisco Secure Email and Web Manager

CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)

Cisco's own advisory names the mechanism plainly: insufficient validation in the email-parsing logic of AsyncOS lets an unauthenticated remote attacker send a single crafted email containing SQL statements through the device, and "a successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system" (Cisco PSIRT, 2026-09-14). CVE-2026-76461 (CVSS 9.8) affects every Cisco Secure Email Gateway, physical and virtual, regardless of configuration; Cisco confirms Secure Email and Web Manager and Secure Web Appliance are not affected by this specific flaw. There is no workaround; the only remediation is upgrading to AsyncOS 15.5.5-014 (re-released on 2026-10-31), 16.0.4-302, or 16.5.0-780, the release Cisco "strongly recommends" migrating to.

Two details in Cisco's own wording raise this above a routine emergency patch. First, Cisco states the vulnerability "was found during the resolution of a Cisco TAC support case" (while the hardening advisory lists the same flaw among those found during internal testing (Cisco PSIRT, hardening-release advisory, 2026-09-14)), and that it has already directly contacted Secure Email Cloud customers on whose devices indicators of compromise were found, having upgraded all Cloud instances itself (Cisco PSIRT, 2026-09-14). Second, CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day and flagged it for Forensic Triage Requirements (CISA KEV, catalogue version 2026.09.14); NCSC-NL's own advisory relays the same exploitation claim: "Cisco reports that successful exploitation of this vulnerability has been observed" (translated from Dutch) (NCSC-NL, NCSC-2026-0368, 2026-09-14).

The same day, Cisco shipped a companion "Security Hardening Release" advisory for the identical product line, bundling five further internally-discovered vulnerabilities that Cisco groups by CWE class rather than by individual flaw: a path-traversal grouping (CVE-2026-76440, CVSS 9.8), an improper-access-control grouping (CVE-2026-76441, CVSS 9.8), an uncontrolled-resource-consumption grouping (CVE-2026-20353, CVSS 9.8), a second injection-class grouping (CVE-2026-76443, CVSS 9.8, in the same weakness class as the exploited CVE-2026-76461) and an input-validation grouping (CVE-2026-76442, CVSS 7.5). Cisco's own table states that "the CVSS score that is assigned to each CVE ID represents the maximum potential severity of the single most impactful underlying vulnerability within that specific CWE category," so the four identical 9.8 scores reflect an assigned ceiling per grouping rather than four independently-confirmed critical bugs. Unlike the exploited flaw, this bundle also affects Secure Email and Web Manager, and Cisco's advisory, revised on 2026-10-14, says two vulnerabilities found in the review are known to be actively exploited: this SQL injection and the separately advised arbitrary file write, which footnotes attach to the injection and path-traversal groupings. Upgrading to 15.5.5-014 or 16.5.0-780 closes the exploited flaw and the hardening CVEs together, while for a 16.0 appliance the hardening advisory names no fixed release and says to migrate, so 16.0.4-302 closes CVE-2026-76461 only (Cisco PSIRT, hardening-release advisory, 2026-09-14).

Builds on: Cisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content…