DaystoPatch

CiscoExploited incident

Cisco Secure Email Gateway SQL Injection Vulnerability

CVE-2026-76461Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 14 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fixUnverified source
Follow-through
0h
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhXCuratedQuote not checked yet

    In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

    Exploitation was first disclosed by this advisory itself; timestamp is the advisory's 'First Published: 2026 September 14 16:00 GMT'. No earlier third-party report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CISA KEV (CVE-2026-76461)ClaimedQuote verified14 Sep 2026

    Cisco Secure Email Gateway SQL Injection Vulnerability

    Added to CISA's KEV catalog on 2026-09-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-76461ClaimedQuote verified14 Sep 2026, 16:09 UTC

    A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ede0eda7ec2e7b35…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 Sep 2026, 17:30 UTC

    CVE-2026-76461 - cisco secure email

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Sep 2026, 21:00 UTC

    🚨 [CISA-2026:0914] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0914 ) CISA has added one new vulnerability to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhXCuratedQuote not checked yet

    First Published: 2026 September 14 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-esa-inj-2bLVGmhXClaimedQuote verified14 Sep 2026, 16:00 UTC

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:15deff9d28629aab…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhXCuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    Advisory v1.0 (2026-SEP-14, 'First Published: 2026 September 14 16:00 GMT') shipped with fixed releases 15.5.5-014, 16.0.4-302 and 16.5.0-780. The only later revision (1.1, 2026-SEP-17) added a clarification about clustered appliances.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:15deff9d28629aab…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-hardening-esa-dfCrfXkm (Security Hardening Release: September 2026)CuratedQuote verified14 Sep 2026, 16:00 UTC

    First Published: 2026 September 14 16:00 GMT

    Companion hardening advisory published at the same time, listing the same first fixed releases (15.5.5-014, 16.5.0-780) and stating that two of the bundled vulnerabilities are actively exploited, linking to this advisory.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ceb975c40e30cf34…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhXCuratedQuote verified

    Cisco has already upgraded all Cisco Secure Email Cloud devices to Release 16.5.0-780.

    Fixed-release table lists a fix for every train (15.5 and earlier: 15.5.5-014; 16.0: 16.0.4-302; 16.5: 16.5.0-780). The revision history shows no later fixed-release additions, so all trains are treated as fixed at first publication (2026-SEP-14).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:15deff9d28629aab…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Cisco Secure Email Gateway flaw exploited; fixed in AsyncOS 16.5.0-780

Attackers have exploited a flaw in Cisco Secure Email Gateway that lets anyone who can send it an email run commands as root; Cisco shipped fixes the day it disclosed the attacks.

In plain words

Cisco's email security gateway had a flaw that let an attacker take full control of the appliance just by sending it a specially crafted email, and Cisco confirmed it was being used in real attacks. Cisco released fixed software on 14 September 2026, the same day it announced the problem. If we run this product on our own premises, we need to upgrade it to a fixed release and check it for signs of compromise. Cisco's cloud-hosted version has already been upgraded by Cisco.

What happened and who is affected

What happened

On 14 September 2026 Cisco disclosed CVE-2026-76461, a SQL injection flaw in the email parsing of AsyncOS Software for Cisco Secure Email Gateway, rated 9.8 out of 10. A crafted email sent through an affected appliance can lead to command execution with root privileges, with no login needed. Cisco said it became aware of active exploitation in September 2026 and released fixed software in the same advisory. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.

Who is affected

On-premises Cisco Secure Email Gateway appliances (physical and virtual) running AsyncOS 15.5 and earlier before 15.5.5-014, 16.0 before 16.0.4-302, or 16.5 before 16.5.0-780. Cisco says it has already upgraded all Cisco Secure Email Cloud devices to 16.5.0-780.

CVE-2026-76461. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2026-76461/

Affected products

  • Cisco Secure Email Gateway (AsyncOS)
  • Cisco Secure Email Cloud
How we built this timeline

Coordinated with the September 2026 Secure Email hardening release (cisco-sa-hardening-esa-dfCrfXkm, 14 Sep 2026), which bundles internally found issues; that advisory says two bundled bugs are actively exploited and links to this advisory and to cisco-sa-esa-afw-zqYJkjxp (CVE-2026-76519, tracked as a separate incident because its exploitation was disclosed a month later in its own advisory). Exploitation was disclosed in the same advisory that shipped fixes, so world = vendor = First fix.

Source per Cisco: found during the resolution of a Cisco TAC support case.

Related

Cisco report card