Vulnpedia
← All CVEs

CVE-2026-76461

CRITICAL 9.8 KNOWN EXPLOITED ALL-YEARS

Published 2026-09-14 · Last modified 2026-09-18 · cisco · NVD: Analyzed

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-09-14. Patch or mitigate now.

Exploitation likelihood

29.5%chance of exploitation in 30 days · 98th percentile

● In CISA KEV (2026-09-14)○ Public exploit / PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

9.8CVSS 3.1 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.

Affected

Vendors Cisco

Products Cisco Secure Email Asyncos Secure Email Gateway Virtual Appliance C100v Secure Email Gateway Virtual Appliance C300v Secure Email Gateway Virtual Appliance C600v Secure Email Gateway C195 Secure Email Gateway C395 Secure Email Gateway C695

Weakness (CWE)

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Affected Software Configurations

VendorProductVersion range
CiscoAsyncos< 15.5.5-014
CiscoAsyncos≥ 16.0 and < 16.0.4-302
CiscoAsyncos≥ 16.5 and < 16.5.0-780

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Sources: NVD · CVE.org · EPSS