CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability | Cyberiack

Skip to content

Actively exploited: added to CISA’s KEV catalog on September 14, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: September 17, 2026.

Description from CISA’s KEV catalog.

Our analyses

Cisco: a booby-trapped email may be enough to take over your gateway, and the flaw is already exploited

Rated 9.8 out of 10, the flaw requires no password or account once attachment scanning is enabled. The patch installs without a reboot: here's how to tell if you're exposed.

Oct 15, 20263 min read

What to do

Check whether your estate includes Cisco Secure Email Gateway, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (sec.cloudapps.cisco.com)
NVD entry (NIST)
CISA KEV catalog

Other Cisco vulnerabilities

All exploited Cisco vulnerabilities