CVE-2026-76461 – Cisco Secure Email
“One crafted email is all it takes to hand an attacker root on the gateway built to stop them.”
Cisco has released software updates for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager that fix five vulnerabilities. Attackers are actively exploiting CVE-2026-76461, an email parsing flaw in Cisco AsyncOS Software. An unauthenticated, remote attacker can send a crafted email containing malicious SQL statements through an affected device. A successful exploit leads to command execution with root privileges on the underlying operating system. CVE-2026-76461 has a CVSS score of 9.8, Critical severity.
The release also fixes four vulnerabilities found in Cisco's internal security review. CVE-2026-20353 has a CVSS score of 9.8, Critical severity, and involves improper control of a resource through its lifetime. CVE-2026-76440 has a CVSS score of 9.8, Critical severity, and involves path traversal. CVE-2026-76443 has a CVSS score of 9.8, Critical severity, and involves improper neutralization. CVE-2026-76442 has a CVSS score of 7.5, High severity, and involves improper validation of a specified quantity in input, with elevation of privilege impact. Patch every affected email gateway and manager now.
Key Details
- Affected Product
- Cisco Asyncos
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-89