CVE-2026-76461

Cisco Secure Email Gateway suffered an unpatched SQL injection flaw allowing remote attackers to execute arbitrary root commands.

An unpatched SQL injection vulnerability in Cisco Secure Email Gateway allowed unauthenticated remote attackers to execute arbitrary commands with root privileges on the underlying OS. This is a critical failure for DIB organizations because it represents a severe exposure where a known, unpatched flaw was actively exploited in the wild, directly impacting compliance with NIST 800-171 requirements for patch management and system hardening. Organizations must ensure all AsyncOS software is updated immediately and assess their exposure to similar unpatched vulnerabilities.

Shame score — A known, unpatched SQL injection vulnerability was actively exploited in the wild, allowing remote attackers to gain root access without authentication, demonstrating severe negligence in patch management and system hardening.