A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since yesterday.

The EPSS score is 0.02162.

Exploitation active

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Secure Email unknown
Version Status Constraints
14.0.0-698 affected —
13.5.1-277 affected —
13.0.0-392 affected —
14.2.0-620 affected —
13.0.5-007 affected —
13.5.4-038 affected —
14.2.1-020 affected —
14.3.0-032 affected —
15.0.0-104 affected —
15.0.1-030 affected —
15.5.0-048 affected —
15.5.1-055 affected —
15.5.2-018 affected —
16.0.0-050 affected —
15.0.3-002 affected —
16.0.0-054 affected —
15.5.3-022 affected —
16.0.1-017 affected —
15.5.4-012 affected —
16.0.4-016 affected —
15.0.5-016 affected —
16.0.2-112 affected —
16.0.3-044 affected —

Configuration 1 [-]

AND
OR cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
OR cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Asyncos Subscribe
Secure Email Gateway C195 Subscribe
Secure Email Gateway C395 Subscribe
Secure Email Gateway C695 Subscribe
Secure Email Gateway Virtual Appliance C100v Subscribe
Secure Email Gateway Virtual Appliance C300v Subscribe
Secure Email Gateway Virtual Appliance C600v Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461 cve-icon cve-icon
History

Tue, 15 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco asyncos
Cisco secure Email Gateway C195
Cisco secure Email Gateway C395
Cisco secure Email Gateway C695
Cisco secure Email Gateway Virtual Appliance C100v
Cisco secure Email Gateway Virtual Appliance C300v
Cisco secure Email Gateway Virtual Appliance C600v
CPEs cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
Vendors & Products Cisco
Cisco asyncos
Cisco secure Email Gateway C195
Cisco secure Email Gateway C395
Cisco secure Email Gateway C695
Cisco secure Email Gateway Virtual Appliance C100v
Cisco secure Email Gateway Virtual Appliance C300v
Cisco secure Email Gateway Virtual Appliance C600v

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Title Cisco Secure Email Gateway SQL Injection Vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

kev

{'dateAdded': '2026-09-14T00:00:00+00:00', 'dueDate': '2026-09-17T00:00:00+00:00'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-09-15T03:56:06.270Z

Reserved: 2026-08-19T12:02:03.637Z

Link: CVE-2026-76461

cve-icon Vulnrichment

Updated: 2026-09-14T16:34:06.587Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T17:17:51.113

Modified: 2026-09-15T12:47:32.497

Link: CVE-2026-76461

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T08:00:16Z

Weaknesses