This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device.
A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Cisco released software updates that address this vulnerability, according to an advisory. There are no workarounds that address this vulnerability.
This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration.
To confirm any attempted exploitation of this vulnerability, review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, review the logs of each cluster device.
The presence of any entry in the output may indicate malicious activity.
CVE-2026-76461 is the case number for the vulnerability, which has a CVSS base score of 9.8.
Cisco AsyncOS for Cisco Secure Email Gateway Software users with versions:
- 15.5 and earlier, that can update to 15.5.5-014
- 16.0, update to 16.0.4-302
- 16.5, update to 16.5.0-780
Click here for other security fixes from Cisco.