Vulnerability

CVE-2026-76461

A critical SQL injection flaw (CVSS 9.8) in Cisco AsyncOS for Secure Email Gateway, letting a crafted email trigger root-level command execution.

Known aliases

AVD-2026-76461
cisco-sa-esa-inj-2bLVGmhX

Current stories

securityConfirmed5 publishers

Exploited Cisco email gateway flaw lets a crafted attachment run commands as root

Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.

Publishers:bleepingcomputer.com scworld.com securityaffairs.com securityweek.com thehackernews.com

Perspective Coverage

5 publishers

Builder: Builder 13%
Operator: Operator 76%
Investor: Investor 11%

Reality

Evidence82
Adoption: Not scored
Hype gap+5
Incentives: Not scored
Confidence78

securityConfirmed10 publishers

Cisco patches an ISE authentication bypass attackers used before the fix existed

CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.

Publishers:bleepingcomputer.com cisa.gov cyberscoop.com helpnetsecurity.com infosecurity-magazine.com networkworld.com scworld.com securityweek.com thecyberexpress.com thehackernews.com

Perspective Coverage

10 publishers

Builder: Builder 16%
Operator: Operator 74%
Investor: Investor 10%

Reality

Evidence82
Adoption: Not scored
Hype gap+5
Incentives30
Confidence80

buildOne report1 publisher

Cisco email gateway flaw runs attacker SQL as root the moment it parses a message

CVE-2026-76461 lets a crafted email run SQL as root on Cisco Secure Email Gateway, with no workaround and a September 17 federal patch deadline from CISA. Because the trigger is mail parsing, every gateway in the mail path is in scope, whether or not it faces the internet.

Publishers:dev.to

Reality

Evidence55
Adoption: Not scored
Hype gap0
Incentives: Not scored
Confidence50

securityOne report1 publisher

Attackers hit Cisco's email gateway with a SQL injection zero-day before the patch shipped

CVE-2026-76461 is one of three flaws confirmed under active attack in a single week. Revolut's customer records left by a different route, a request sent from an email address on a government agency's own domain.

Publishers:helpnetsecurity.com

Reality

Evidence42
Adoption62
Hype gap+12
Incentives58
Confidence47

securityOne report1 publisher

Cisco has already contacted Secure Email Cloud customers where it found compromise indicators

CVE-2026-76461 was in use before Monday's advisory and Cisco says multiple customers were likely compromised first, so a gateway patched this week still needs a hunt against indicators that root access can erase.

Publishers:cyberscoop.com

Reality

Evidence72
Adoption58
Hype gap0
Incentives55
Confidence66

securityOne report1 publisher

A crafted email is already getting root on unpatched Cisco Secure Email Gateways

CVE-2026-76461 is under active exploitation, hits every physical and virtual Secure Email Gateway whatever its configuration, and has no workaround. CISA gave federal civilian agencies until September 17 to install the fixed builds.

Publishers:thehackernews.com

Reality

Evidence72
Adoption55
Hype gap0
Incentives60
Confidence68