{"id":"CVE-2026-76461","kind":"vulnerability","aliases":["CVE-2026-76461"],"related":[],"title":"A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an…","description":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Cisco Secure Email Gateway's AsyncOS software has a SQL injection flaw that an unauthenticated remote attacker can use to run arbitrary commands as root on the underlying OS. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-14T00:00:00+00:00","products":[{"name":"Cisco Secure Email Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco asyncos","fixed":["15.5.5-014"],"affected":"< 15.5.5-014","ecosystem":"vendor"},{"name":"cisco asyncos","fixed":["16.0.4-302"],"affected":">= 16.0, < 16.0.4-302","ecosystem":"vendor"},{"name":"cisco asyncos","fixed":["16.5.0-780"],"affected":">= 16.5, < 16.5.0-780","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asyncos","cisco","email-infrastructure","exploited","secure-email-gateway","vendor"],"not_affected_if":["not-using-cisco-seg"],"how_to_check":"Confirm whether you run Cisco Secure Email Gateway (AsyncOS) and which build it is on; the sources do not give a check command or file.\nCheck the Cisco security advisory for affected and fixed versions (not provided in the sources).","fix":"Apply the Cisco vendor mitigation or patch per CISA BOD 26-04 guidance; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product as CISA directs.","status":"open","published_at":"2026-09-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:31+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:31:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco vendor mitigation or patch per CISA BOD 26-04 guidance; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product as CISA directs.","summary":"Cisco Secure Email Gateway's AsyncOS software has a SQL injection flaw that an unauthenticated remote attacker can use to run arbitrary commands as root on the underlying OS. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["cisco","secure-email-gateway","asyncos","email-infrastructure"],"confidence":0.6,"analyst_note":"Find Cisco's advisory for CVE-2026-76461 to get affected and fixed AsyncOS versions, a mitigation, and a detection method; the KEV entry alone lacks these.","how_to_check":"Confirm whether you run Cisco Secure Email Gateway (AsyncOS) and which build it is on; the sources do not give a check command or file.\nCheck the Cisco security advisory for affected and fixed versions (not provided in the sources).\nunknown","needs_analyst":true,"not_affected_if":["not-using-cisco-seg"],"severity_if_unknown":"critical"},"cost_usd":0.000436,"input_tokens":2236,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':133C,159C,190C '-2026':19A,22A '-76461':20A,23A '26':132C,158C,189C 'accord':122C 'action':118C 'activ':78B 'adher':186C 'allow':17A,99C 'appli':119C 'applic':156C 'arbitrari':66B,106C 'asset':180C 'asynco':9A,34B,50B,84C 'asyncos':29A,31A,33A 'attack':61B,103C 'base':137C 'bod':131C,157C,188C 'cisa':74B,116C,129C,146C 'cisco':8A,12A,24A,28A,30A,32A,35B,45B,83C,87C 'cloud':162C 'command':67B,107C 'complianc':127C 'contain':92C 'could':16A,98C 'cve':18A,21A 'discontinu':165C 'email':5A,14A,26A,37B,42B,47B,89C 'email-infrastructur':36B 'ensur':126C,185C 'evalu':178C 'execut':105C 'exploit':39B,79B 'exposur':183C 'flaw':56B 'follow':155C 'forens':148C 'gateway':15A,27A,43B,48B,90C 'guidanc':144C,160C 'guidelin':192C 'infrastructur':38B 'inject':55B,95C 'instruct':125C 'internet':182C 'list':75B 'mitig':120C,171C 'note':143C,154C 'oper':114C 'os':73B 'pars':6A 'patch':191C 'priorit':134C 'privileg':110C 'product':169C 'remot':60B,102C 'requir':117C,150C 'respons':176C 'risk':139C 'root':69B,109C 'run':65B 'secur':13A,41B,46B,88C,135C 'secure':25A 'secure-email-gateway':40B 'see':140C,151C 'seg':91C 'servic':163C 'softwar':10A,51B,85C 'sql':54B,94C 'stakehold':174C 'system':115C 'triag':149C 'unauthent':59B,101C 'unavail':173C 'under':72B,113C 'updat':136C 'url':141C,152C 'use':63B,166C 'vendor':44B,124C 'vulner':2A,96C 'wild':82B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-14T00:00:00+00:00","kev":{"dateAdded":"2026-09-14","dueDate":"2026-09-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-76461","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461","severity":null,"published_at":"2026-09-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-76461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76461","severity":null,"published_at":"2026-09-14T17:17:51+00:00","modified_at":"2026-09-15T12:47:32+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}