Cisco Secure Email Gateway SQL Injection Vulnerability Added to KEV List

## Overview CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalog on September 14, 2026. This vulnerability impacts Cisco AsyncOS Software for Cisco Secure Email Gateway. It allows unauthenticated, remote attackers to execute arbitrary commands with root privileges. ## Technical Details The vulnerability arises from insufficient validation in the email parsing logic. An attacker can exploit this flaw by sending a specially crafted email containing malicious SQL statements. If successful, the attacker can execute arbitrary SQL commands, leading to command execution with root privileges on the underlying operating system. ## Impact The potential impact is severe. An attacker gaining root access can compromise the entire system. This could lead to data breaches, unauthorized access to sensitive information, and further exploitation of the network. The CVSS score of 9.8 indicates a critical risk, making immediate action necessary. ## Mitigation Defenders should prioritize patching affected systems. Cisco has released updates to address this vulnerability. Organizations must ensure their Secure Email Gateway is running the latest software version. Regularly reviewing email parsing configurations and monitoring logs for unusual activity can also help mitigate risks.