CVE-2026-76461
One crafted email can give an unauthenticated attacker root command execution on Cisco Secure Email Gateway.
No management access or recipient action is required.
Affects
Cisco Secure Email Gateway, physical and virtual email-security appliances running AsyncOS.
What it enables
Unauthenticated root command execution through email delivery
Send an email containing crafted SQL through the target gateway.→↓The email parser passes the malicious statements into the appliance database.→↓Use database program execution to run operating-system commands.→↓Execute commands as root on the gateway and access appliance or cluster credentials.
Why this matters
The gateway processes the hostile object itself, and Cisco reports exploitation of the message-to-database-to-root path.
Detail and 4 sources
Insufficient parser validation lets crafted SQL reach the appliance database; PostgreSQL program execution then reaches operating-system commands running as root.
Cisco reports exploitation and has published fixed AsyncOS releases. Pre-fix images remain accepted.
Evidence
Cisco advisory confirms crafted-email delivery, arbitrary SQL, root command execution, exploitation and fixesJPCERT/CC independently confirms that receipt by the gateway needs no recipient action and can execute commands as root
Preconditions
- access:network:internet
- reachable from the public internet
- interaction:none
- no user action required
Patch reality
- Pre-fix images still accepted
- Yes
- Reaches end-of-life hardware
- No
Cisco’s x90 hardware notice places the last date of support and vulnerability/security support at September 30, 2025.
Sources
ResearchCisco Secure Email Gateway SQL Injection Vulnerability - CiscoResearchCritical Cisco Secure Email Gateway zero-day gives attackers root access | CSO OnlineResearchCisco Secure Email GatewayにCVSS 9.8のSQLインジェクション — 細工したメール1通でroot権限のコマンド実行、Ciscoが能動的な悪用を確認し修正版を公開（CVE-2026-76461） | NEXSIGHT CYBER WIREVendorCisco Secure Email Gateway SQL Injection Vulnerability