CVE-2026-76461 · High · CISA KEV

Cisco Secure Email Gateway SQLi: Unauthenticated Root RCE, Actively Exploited

Threat Engine Auto-Feed · data current as of 2026-09-15

A critical SQL injection vulnerability in Cisco Secure Email Gateway (SEG) AsyncOS software allows unauthenticated, remote attackers to achieve root-level command execution. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, and has a high exploitation probability (EPSS 81st percentile).

  • CVSS:
  • EPSS percentile: 0.81239
  • Exploitation pressure: 74/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 81th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is a SQL injection, which occurs when an attacker can insert or "inject" malicious SQL code into an input field that is then processed by a database. This can trick the database into executing unintended commands, potentially allowing the attacker to read, modify, or delete data, or in this case, execute arbitrary commands on the underlying system.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Cisco Secure Email Gateway (SEG) for email security, particularly those in financial services and technology sectors, due to documented adversary targeting.
  • Any enterprise where email gateway devices are critical infrastructure components.

Misconfigurations that escalate it

  • Lack of robust network segmentation that could limit post-exploitation lateral movement.
  • Insufficient monitoring of email gateway logs for unusual activity or command execution.

High-impact scenarios

  • An unauthenticated attacker gaining root-level remote code execution on the email gateway, leading to full compromise of the device.
  • Attackers using the compromised email gateway as a pivot point to access internal networks, distribute malware, or exfiltrate sensitive data.
  • Disruption of critical email services due to device compromise or manipulation.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Cisco Secure Email Gateway logs for any anomalous command execution or unauthorized access attempts.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic patterns originating from or targeting the SEG.
  • Regularly review system configurations and access logs for the Cisco Secure Email Gateway.

Contain

  • Isolate affected Cisco Secure Email Gateway devices from the broader network if compromise is suspected.
  • Review and restrict network access controls to and from the SEG to only essential services and hosts.
  • Perform forensic analysis on compromised devices to understand the extent of the breach and identify any persistence mechanisms.

Patch

  • Apply vendor-provided patches for Cisco AsyncOS software on Secure Email Gateway immediately upon availability.
  • Follow Cisco's security advisories and recommendations for mitigating this specific vulnerability.

Frontier verdict — High

This is a critical, actively exploited vulnerability in Cisco Secure Email Gateway allowing unauthenticated root RCE, demanding immediate patching and enhanced monitoring.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.