CVE-2026-76461 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-14

Added to CISA KEV: 2026-09-14 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — ACTIVE EXPLOITATION IN CISA KEV: Treat this as an emergency incident response situation. Check immediately for indicators of compromise: review AsyncOS system logs for anomalous SQL activity, unexpected process spawning, unauthorized outbound connections, and new administrative accounts. Assume compromise if patching has been delayed.
PATCH IMMEDIATELY: Apply the latest fixed version of Cisco AsyncOS for Secure Email Gateway as published in Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX. Prioritize this above all other patching activity given active exploitation.
ISOLATION: If immediate patching is not possible within hours, consider temporarily routing inbound email through an alternative path or enabling emergency SMTP filtering rules upstream (at the firewall/ISP level) to limit crafted email delivery while patch is applied.
THREAT HUNT: Audit the SEG appliance for signs of post-exploitation activity including: unexpected cron jobs, new SUID binaries, modified system files, unauthorized SSH keys, unexpected listening ports, and signs of data staging or exfiltration.
MONITOR: Implement enhanced logging and SIEM alerting for the SEG appliance. Monitor for: unusual process execution chains originating from the mail processing daemon, unexpected database query patterns, and outbound connections to non-standard destinations.
NETWORK CONTROLS: While SMTP port 25 must remain open for email delivery, ensure all OTHER ports on the SEG appliance (management UI, SSH, API) are restricted to trusted management networks only. Reduce the management attack surface even if SMTP cannot be restricted.
PATCH PRIORITY: CRITICAL / IMMEDIATE — this is a pre-auth RCE with confirmed active exploitation. Federal agencies subject to CISA KEV directives must remediate by the KEV-specified deadline. All other organizations should treat this as P1/SEV1.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-76461 is a critical SQL injection vulnerability residing in the email parsing logic of Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) . This flaw allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system by sending a specially crafted email . Given its severity (CVSS 9.8) and the ability to gain full system control, it poses a severe threat to organizations relying on this gateway for perimeter security .

Exploitation

Active Exploitation: There are reports of active exploitation of this vulnerability in the wild .
CISA Status: The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its list of Known Exploited Vulnerabilities (KEV) .
Threat Actors: While specific threat actors or ransomware campaigns are not currently named, the nature of the exploit and its status as a widely targeted vulnerability suggest high-level malicious interest.
Attack Prerequisites: The attack can be performed remotely by an unauthenticated attacker, does not require user interaction, and leverages crafted email messages to trigger the vulnerability .

Affected Products & Patches

Affected Products: Cisco Secure Email Gateway (SEG) running vulnerable versions of Cisco AsyncOS software .
Patches/Hotfixes: Users are advised to monitor official Cisco security advisories for patch availability and apply updates immediately.
Mitigations: Organizations should restrict access to the management interface and verify email filtering configurations to identify potentially malicious input patterns.

Impact

Access/Capabilities: Successful exploitation grants the attacker full root-level command execution on the underlying operating system of the appliance .
Business Risk: For internet-facing deployments, this vulnerability allows attackers to gain an initial foothold, bypass perimeter security, potentially exfiltrate sensitive email traffic, or pivot deeper into the internal corporate network, leading to full system compromise.