CVE-2026-76461: Critical RCE in Cisco Secure Email Gateway

CVE-2026-76461 resides in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway. Insufficient validation in message processing allows an unauthenticated remote attacker to send crafted emails containing malicious SQL statements. When processed by the gateway, these statements are executed, leading to command execution with root privileges on the underlying operating system. This is an unauthenticated remote code execution (RCE) vulnerability on a critical business communication infrastructure.

Official CVSS rating is 9.8, classified as Critical. The vulnerability was confirmed by NVD on September 14, 2026. As of November 4, 2026 (today), significant activity signals are observed on technical discussion channels, with 5 posts in the last 24 hours and the most recent update received today. These signals suggest renewed interest in the issue, potentially linked to availability of new patches or rediscovery of vulnerable configurations in the field. Social signals indicate engagement from the security community on mitigation strategies.

For defenders: inventory all Cisco Secure Email Gateway instances and verify their version. Contact Cisco to confirm the vulnerable version number and access the official patch. Schedule the update with critical priority. Strengthen monitoring of application logs for anomalous email parsing patterns and suspicious SQL statements. If available, apply Web Application Firewall rules to filter SQL characters in email fields.