CVE-2026-76461: SQL injection in Cisco Secure Email Gateway yields root

CVE-2026-76461 in Cisco Secure Email Gateway on AsyncOS lets an unauthenticated remote attacker exploit SQL injection to run commands as root. CISA added it to the Known Exploited Vulnerabilities catalog on 14 September 2026 with a federal remediation deadline of 17 September. The fix is upgrading AsyncOS to 16.5.0-780 or later.

• Affects AsyncOS 16.0.4-3021 and later; fixed in 16.5.0-780
• Exploitation is pre-authentication and results in root on the appliance
• CISA added the CVE to KEV on 14 September, deadline 17 September 2026
• Post-patch checks include rotating credentials and reviewing filter rules