What is the CVSS score of CVE-2026-76461?

CVE-2026-76461 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Which versions of Cisco Secure Email are affected by CVE-2026-76461?

We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461.

Is there a public PoC exploit available for CVE-2026-76461?

Yes, a public proof-of-concept exploit is available for CVE-2026-76461. Prioritise patching immediately.

Cisco Secure Email CVE-2026-76461

EUVD-2026-77625 CRITICAL

SQL Injection (CWE-89)

2026-09-14 cisco

GHSA-jwpf-jww6-h6vr

SQLi Cisco Cisco Secure Email

9.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Threat Model Generated

Sep 15, 2026 - 11:33 vuln.today

Analysis Generated

Sep 15, 2026 - 11:24 vuln.today

Added to CISA KEV

Sep 14, 2026 - 19:48 CISA

CVE Published

Sep 14, 2026 - 16:09 cve.org

CRITICAL 9.8

DescriptionCVE.org

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.