CVE-2026-76461: Actively Exploited SQL Injection in Cisco Secure Email Gateway Hits CISA KEV

Cisco confirmed active exploitation of CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway and Secure Email and Web Manager, added to CISA’s Known Exploited Vulnerabilities catalog on September 14, 2026. Cisco patched it alongside three other vulnerabilities affecting the same product line, CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441. If your organization runs Secure Email Gateway or Secure Email and Web Manager, this is a confirmed real-world attack against your specific product line, not a theoretical risk.

What CVE-2026-76461 actually is

CVE-2026-76461 is a SQL injection flaw in Cisco Secure Email Gateway and Secure Email and Web Manager. SQL injection in an email security appliance is a particularly serious combination, these appliances sit directly in the path of inbound mail, are internet-facing by design, and often hold credentials or configuration data an attacker would want. Cisco has confirmed this specific flaw is being actively exploited, and CISA’s KEV catalog addition on September 14, 2026 formally validates that assessment for anyone deciding how urgently to prioritize this patch.

The other three vulnerabilities patched in the same release

Cisco addressed CVE-2026-76461 as part of a broader security hardening release also covering:

• CVE-2026-20353: an improper neutralization vulnerability that could allow command, SQL, or code/eval injection, or cross-site scripting attacks against an affected device, along with uncontrolled resource consumption and deserialization errors during data handling.
• CVE-2026-76440 and CVE-2026-76441: additional critical vulnerabilities affecting the same appliance line.

None of these three are currently confirmed as actively exploited the way CVE-2026-76461 is, but they were patched together in the same release for a reason, an appliance with several distinct injection-class vulnerabilities in a single security hardening release deserves patching in full, not selectively addressing only the one with confirmed exploitation while leaving related flaws in the same codebase unpatched.

Fixed versions

# Confirm your current AsyncOS version first
# Fixed releases (per Cisco's advisory):
#   16.5.0-780
#   16.0.4-3021
#   15.5.5-0141
# Affected release branches: 15.5, 16.0, 16.5

# Verify your specific deployed version against Cisco's official
# security advisory directly before assuming which fixed build
# applies to your branch

Apply the fixed release for your branch as soon as your change process allows. Given confirmed active exploitation of at least one of the bundled vulnerabilities, this isn’t a “schedule it for the next maintenance window” situation, treat it with the same urgency as any other confirmed-exploited, internet-facing appliance vulnerability.

Why email gateway appliances specifically deserve this level of urgency

Secure email gateways are a genuinely attractive target: they’re internet-facing by necessity (they have to receive inbound mail from anywhere), they process large volumes of untrusted, attacker-controlled content by design (every inbound email is technically untrusted input), and a compromise gives an attacker a foothold sitting directly in an organization’s mail flow, potentially enabling further phishing, mail interception, or lateral movement into the broader network. This isn’t a unique risk to Cisco’s product specifically, it’s the general risk profile of any email security appliance, which is exactly why confirmed exploitation against one deserves fast, full patching rather than a wait-and-see approach.

Frequently asked questions

We can’t patch immediately due to change control. What’s a reasonable interim step?
Check Cisco’s advisory for any documented interim mitigations or configuration changes that reduce exposure while patching is scheduled, restricting management interface access to trusted networks is a reasonable general interim step for any appliance vulnerability, though it doesn’t substitute for the actual patch, especially for a confirmed actively-exploited flaw like this one.

How can we tell if we’ve already been targeted by this specific vulnerability?
Review Secure Email Gateway logs for anomalous database query patterns, unexpected administrative actions, or unusual outbound connections from the appliance itself, SQL injection exploitation often leaves traces in application-level logs even when it doesn’t trigger an obvious alert. Cisco’s advisory may also include specific indicators of compromise worth checking against your own logs directly.

Does this affect Cisco Secure Email cloud-hosted offerings, or only on-premises appliances?
Confirm against Cisco’s specific advisory for your deployment model, the affected release branches listed are specific to the appliance software, cloud-hosted or Cisco-managed deployments may have different patching timelines or may already be remediated on Cisco’s side, verify rather than assume either way.