CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-09-14Vulnerability

CVE-2026-76461

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Properties

Euvd product
Cisco Secure Email
Vulnerability name
Cisco Secure Email Gateway SQL Injection Vulnerability
First seen
2026-09-18T12:10:27+00:00
Cvss score
9.8
Epss score
0.29543
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-09-17
Euvd assigner
cisco
Retrieved at
2026-10-31T00:15:03+00:00
Exploited euvd since
2026-09-14T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2026-09-14
Score
9.8
Euvd base score version
3.1
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Cisco
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
First seen by Signal
2026-09-14T23:09:20+00:00
Euvd base score
9.8

Related Entities (12)

AFFECTS_PRODUCT (7)

→[Product]cisco secure email gateway virtual appliance c100v
→[Product]cisco secure email gateway virtual appliance c600v
→[Product]cisco secure email gateway c195
→[Product]cisco secure email gateway c395
→[Product]cisco secure email gateway virtual appliance c300v
→[Product]cisco asyncos
→[Product]cisco secure email gateway c695

MENTIONED_IN (2)

→[Campaign]Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
→[Campaign]The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

DESCRIBES (1)

←[KEVEntry]Cisco Secure Email Gateway SQL Injection Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

INVOLVES (1)

←[Signal]kev_added · 2026-09-14

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-76461 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal