VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 10:07 UTC

CVE-2026-76461

Read full description

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

1.1/10

REALITY · THREAT PRIORITY

8.6/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.8: +1.47
Fresh EPSS: 29.54%: +0.15

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 22 documents and public datasets.

Hype components

Headline sample (25%)

30/100

Press, 30 days (60%)

5/100

Grounded branding (15%)

0/100

HYPE TOTAL10/100

Sources and documents

Cisco Security Advisory

Technical advisory · 03 Nov 2026, 17:05 · Cisco Secure Email Gateway SQL Injection Vulnerability

The Hacker News

Press · 14 Oct 2026, 07:00 · Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability - The Hacker News

The Register

Press · 17 Sep 2026, 07:00 · Cisco drops another exploited zero-day, this time a perfect 10 - The Register

Cybersecurity Dive

Press · 16 Sep 2026, 07:00 · Hackers exploit zero-day flaw in Cisco email gateway - Cybersecurity Dive

SOCRadar

Press · 16 Sep 2026, 07:00 · CVE-2026-76461: Cisco Email Gateway Flaw Exploited - SOCRadar

See all 22 source documents

Rescana

Press · 16 Sep 2026, 07:00 · Active Exploitation Alert: Cisco Secure Email Gateway AsyncOS SQL Injection (CVE-2026-76461) Added to CISA KEV — Unauthenticated Root via Crafted Email - Rescana

eSecurity Planet

Press · 16 Sep 2026, 07:00 · Cisco Secure Email Gateway Zero-Day Exploited for Root Command Execution - eSecurity Planet

CyberSecurityNews

Press · 15 Sep 2026, 07:00 · Cisco Secure Email Gateway 0-day Vulnerability Actively Exploited in the Wild to Run Malicious Code - CyberSecurityNews

BetaNews

Press · 15 Sep 2026, 07:00 · Cisco Secure Email Gateway flaw exploited for root access - BetaNews

Arctic Wolf

Press · 15 Sep 2026, 07:00 · Recommendations for CVE-2026-76461 - Arctic Wolf

Hong Kong Computer Emergency Response Team Coordination Centre

Press · 15 Sep 2026, 07:00 · Cisco Products Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre

BleepingComputer

Press · 15 Sep 2026, 07:00 · Cisco patches Secure Email Gateway zero-day exploited in attacks - BleepingComputer

Rapid7

Press · 15 Sep 2026, 07:00 · CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild - Rapid7

The Hacker News

Press · 15 Sep 2026, 07:00 · Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution - The Hacker News

Help Net Security

Press · 15 Sep 2026, 07:00 · Cisco patches actively exploited email gateway zero-day (CVE-2026-76461) - Help Net Security

SOC Prime

Press · 15 Sep 2026, 07:00 · CVE-2026-76461: Critical Cisco Secure Email Gateway Zero-Day Enables Root RCE - SOC Prime

SecurityWeek

Press · 15 Sep 2026, 07:00 · Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation - SecurityWeek

Sophos

Press · 15 Sep 2026, 07:00 · Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation - Sophos

CyberScoop

Press · 15 Sep 2026, 07:00 · Cisco warns customers of actively exploited zero-day in email gateways - CyberScoop

Arctic Wolf

Press · 14 Sep 2026, 07:00 · Recommendations for CVE-2026-84869 - Arctic Wolf

Arctic Wolf

Press · 06 Apr 2026, 23:31 · CVE-2026-35616: Fortinet Releases Hotfix for Critical Exploited Vulnerability in FortiClient EMS - Arctic Wolf

Arctic Wolf

Press · 09 Feb 2026, 22:17 · CVE-2026-21643: Critical SQL Injection in FortiClientEMS - Arctic Wolf

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 1.1 · reality 8.6 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.8; EPSS 29.5%
Attention, last 30 days: 1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:25.177862+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

09 Feb 2026, 22:17

Added to the CISA KEV catalog

14 Sep 2026, 00:00

Published

14 Sep 2026, 16:09

Latest press mention

14 Oct 2026, 07:00

Score calculated

05 Nov 2026, 14:00