CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Other sources
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
— CISA
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated remote attacker can exploit it by sending a crafted email message through an affected Cisco Secure Email Gateway device. No prior access or user interaction is described as necessary.
What level of access could a successful attacker obtain?
Successful exploitation can allow arbitrary SQL statements to be executed and can lead to arbitrary command execution with root privileges on the underlying operating system.
What should defenders look for to identify exploitation attempts?
The provided information identifies crafted email messages containing malicious SQL statements as the exploit vector. It does not provide specific log entries, indicators of compromise, or detection signatures.