Cisco Secure Email Gateway SQL Injection Vulnerability Added to CISA KEV

What's on the official record

14 September — CISA added CVE-2026-76461 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes a SQL injection vulnerability (CWE-89) in Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. CISA's remediation due date for federal civilian agencies is 17 September 2026. The record names no fixed version; the fix field points to the vendor advisory. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.295 probability of exploitation (98th percentile, 23 October 2026). CISA's ADP assesses exploitation as active, automatable, with total impact.

Assessment

For a platform or AI-stack owner, the record lets you check whether your estate runs Cisco Secure Email Gateway on an affected AsyncOS version and decide whether to patch, isolate, or pull that version. The catalog names no fixed version, so the vendor advisory is the reference for the remediation action to take. CISA's due date for federal agencies is a benchmark for how quickly to move.

For a cyber underwriter, the record lets you check whether a policyholder's estate includes Cisco Secure Email Gateway and whether the affected AsyncOS version is present, to decide whether to require a control or price the exposure. The catalog records no known ransomware use, and the fix field points to the vendor advisory rather than a named fixed version. The EPSS estimate and CISA's active-exploitation assessment are inputs to how you price or condition the risk.

What would change this call

A named fixed version in the vendor advisory, or a change in CISA's exploitation assessment, would sharpen the patch-or-isolate decision and the underwriting posture.

What to check next

Check	Why
Vendor advisory for a named fixed version	The record names no fixed version; the advisory is the remediation reference
Whether affected AsyncOS versions are present in the estate	Determines patch, isolate, or pull
CISA ADP SSVC updates	Exploitation is assessed active; a change would alter urgency

Confidence

Filed 25 October 2026 from the record dated 14 September 2026.

Sources

[1] Cisco Secure Email Gateway SQL Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-76461

[2] CVE record CVE-2026-76461 — https://www.cve.org/CVERecord?id=CVE-2026-76461

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

AI assistants read this note with get_note cyb-20260914-cve-2026-76461. Connect yours