Patch Forecast
Red warning
Act within 24 hours. CISA deadline for US federal agencies: 17 Sep 2026.

CVE-2026-76461 Exploited in the wild

Cisco Secure Email Gateway SQL Injection Vulnerability

Risk score
83/100
CVSS
Not Scored
Added to CISA's exploited list
14 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
Affected
Cisco Secure Email Gateway
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploited in the wild

Story map

Story map: Cisco Secure Email GatewayTHE FLAWSTHE FIXCVE-2026-76461Cisco Secure Email GatewaySQL Injection VulnerabilityexploitedCVE-2026-76519Cisco Secure Email GatewayRelative Path TraversalVulnerabilityCVSS 9.8 · EPSS 2% · exploitedFixApply mitigations in accordancewith vendor instructionsWho is exposed{'product': 'Cisco Secure EmailGateway', 'package': 'AMPfeature', 'version': 'allversions'}RED · ACT TODAYCisco SecureEmail GatewayA vulnerability in Cisco SecureEmail Gateway's AMP featureallows an attacker to writearbitrary files on the underlyingOS, potentially executingcommands with root privileges.An attacker could exploit this…Where it standsExploited in the wildOn CISA's exploited list since 14 SepUS federal deadline 17 SepHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.14 Sep · CISAAdded to the Known Exploited Vulnerabilities list (2of these flaws)17 Sep · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessSQL injection (CWE-89)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Cisco Secure Email Gateway: Red, act today. A vulnerability in Cisco Secure Email Gateway's AMP feature allows an attacker to write arbitrary files on the underlying OS, potentially executing commands with root privileges. An attacker could exploit this by sending a crafted email attachment through an affected device.

The flaws

  • CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability (exploited)
  • CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVSS 9.8 · EPSS 2% · exploited)

The fix

Fix: Apply mitigations in accordance with vendor instructions

Who is exposed: {'product': 'Cisco Secure Email Gateway', 'package': 'AMP feature', 'version': 'all versions'}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 14 Sep
  • US federal deadline 17 Sep

How it unfolded

  1. 14 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (2 of these flaws)
  2. 17 Sep, Deadline (official): US federal agencies must have patched

Connects to

Why it is Red

  • Not yet scored by NVD
  • Exploited in the wild (CISA KEV)
  • On your watchlist: cisco

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Original description

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Last activity 14 Sep 2026. Patch Forecast updates every hour.