Threat Intel
Cisco Secure Email Gateway & AsyncOS: Multi‑Vulnerability Alert – RCE, DoS, SQLi
A wave of security flaws has been uncovered across Cisco’s Secure Email Gateway, Secure Email and Web Manager, and AsyncOS platforms. Several of the bugs enable attackers to execute arbitrary code remotely, crash the system, and inject malicious SQL statements. Cisco’s CVE‑2026‑76461 is already being actively exploited. Immediate patching is mandatory for all affected versions, and network operators should verify that hardening guidelines are in place.
A recent alert from the French CSIRT highlights a collection of critical vulnerabilities in Cisco’s Secure Email Gateway (SEG), Secure Email and Web Manager (SEWM), and AsyncOS firmware. The flaws span several attack vectors: remote code execution (RCE), remote denial‑of‑service (DoS), cross‑site scripting (XSS), and SQL injection (SQLi). Cisco’s own advisory notes that CVE‑2026‑76461 is currently being exploited in the wild.
Impact
- Remote Code Execution: An attacker can run arbitrary commands on the affected device, potentially taking full control.
- Remote Denial of Service: Legitimate traffic can be disrupted, leading to service outages.
- SQL Injection: Sensitive data may be exfiltrated or the database corrupted.
- Cross‑Site Scripting: Compromise of web‑based management interfaces.
Affected Products & Versions
- AsyncOS for Secure Email Gateway – 16.0.x prior to 16.0.4‑3021
- AsyncOS for Secure Email Gateway – 16.5.x prior to 16.5.0‑780
- AsyncOS for Secure Email Gateway – any version prior to 15.5.5‑0141
- Secure Email and Web Manager – 16.x prior to 16.5.0‑429
- Secure Email and Web Manager – any version prior to 15.5.5‑006
- Secure Email Gateway – 16.x prior to 16.5.0‑780
- Secure Email Gateway – any version prior to 15.5.5‑014
CVE Highlights
- CVE‑2026‑76461 – actively exploited RCE
- CVE‑2026‑76440, ‑76441, ‑76442, ‑76443 – DoS and XSS issues
- CVE‑2026‑20353 – additional remote code execution vector
Mitigation
- Apply the latest Cisco security patches immediately. Refer to the Cisco Security Advisories released on 14 September 2026 for detailed fix information.
- Verify that hardening recommendations (e.g., disabling unused services, enforcing strong authentication) are in place.
- Conduct a rapid vulnerability scan of all SEG, SEWM, and AsyncOS devices to confirm patch status.
- Monitor logs for unusual authentication attempts, SQL queries, or service crashes.
Failure to remediate these vulnerabilities exposes organizations to potential data breaches, service interruptions, and complete takeover of email infrastructure. Prompt action is essential to safeguard mission‑critical communications.
Related vulnerabilities
Critical SQL Injection in Cisco Secure Email Gateway Grants Root Access
A new flaw in Cisco’s AsyncOS email parsing logic lets unauthenticated attackers send a crafted message that injects SQL, triggering arbitrary commands with root privileges on the host. The vulnerability, CVE‑2026‑76461, is critical and has no workaround—only a patch. Cisco has released updates; systems must upgrade immediately to avoid a full compromise.
Read briefing
Cisco Hardens Secure Email Gateway with Critical Patch for Exploited SQL Injection
Cisco rolled out a hardening update for its Secure Email Gateway and Secure Email & Web Manager after an internal audit uncovered several critical flaws, including a live SQL injection exploit. The fix bundles five CVEs (CVE‑2026‑20353, 76440‑76443) into a single patch with no workarounds, demanding immediate action from customers to maintain email security.
Read briefing
Oracle Database Server Hit by Multi‑Vulnerability Storm: Remote Code Execution & DoS
A wave of critical flaws in Oracle Database Server—spanning 19.3 through 23.26.3—enables attackers to launch remote code execution and denial‑of‑service attacks. The vulnerabilities, catalogued under CVE‑2026‑83088 to CVE‑2026‑83351, affect all major releases from 19.3 to 23.26.3. Oracle has released patches in the 15 September 2026 security bulletin. Immediate patching is mandatory for any exposed database instances. CERT‑FR has issued an alert urging rapid remediation.
Read briefing
Cisco FMC Faces Critical Vulnerabilities: Root Access, SQLi, and DoS Risks
Cisco’s Secure Firewall Management Center (FMC) is now exposed to a suite of critical flaws that could let attackers gain full root control, steal confidential data, inject malicious SQL, or crash the system. No workarounds exist, but Cisco has issued patches. Immediate update is mandatory for all FMC deployments.
Read briefing