CVE-2026-76461: Cisco Secure Email Gateway — Root RCE via SQLi (September 2026)

CVE-2026-76461 — Cisco Secure Email Gateway

CVE-2026-76461 is a critical SQL injection vulnerability in Cisco Secure Email Gateway appliances and cloud devices. It enables remote attackers to execute arbitrary commands as root. Cisco has confirmed active exploitation since September 2025. Immediate patching and incident response are required.

Attack Vector

Attackers exploit a SQL injection flaw exposed to the internet, requiring no authentication. Successful exploitation provides root shell access, allowing attackers to manipulate, delete, or exfiltrate data and erase forensic evidence. Cisco has published indicators of compromise for detection, including anomalous SQL queries and unauthorized root-level processes.

Who Is at Risk

All organizations running Cisco Secure Email Gateway—both on-premises appliances and cloud-hosted instances—are at risk. Cisco has confirmed compromise of customer devices globally. No specific version exclusions have been provided; all supported versions should be considered vulnerable until patched.

Patch & Mitigate

• Patch: Apply Cisco’s official security update for CVE-2026-76461 immediately. Refer to Cisco’s advisory for version details and patch links.
• Workaround: No official workaround is available; disabling external access to management interfaces may reduce risk until patched.
• Detect: Review logs for unexpected SQL queries, unauthorized root-level command execution, and any indicators of compromise provided by Cisco. Monitor for abnormal outbound connections from affected devices.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit a public-facing application vulnerability to gain entry.
• TA0002 — Execution: Remote command execution as root enables arbitrary code to run on the device.
• TA0005 — Defense Evasion: Attackers may delete logs or alter evidence to avoid detection and maintain persistence.

Source: https://www.helpnetsecurity.com/2026/09/15/cve-2026-76461-cisco-email-gateway-zero-day-exploited/