Cisco Secure Email CVE-2026-76461

No special conditions - remote unauthenticated exploitation of Cisco Secure Email Gateway (AsyncOS) simply by sending a crafted email message containing malicious SQL through the affected device, which processes inbound mail by default. The only precondition is that the appliance is in the mail-processing path (its normal deployment role), so essentially any internet-facing or mail-receiving ESA running an affected AsyncOS build is exposed. No authentication, no user interaction, and no non-default feature toggle are required per the CVSS vector and description; the limiting factor is version - only the enumerated AsyncOS builds are affected.

This is a genuine top-priority vulnerability, not an inflated high-CVSS artifact. Multiple independent signals converge: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes remote, unauthenticated, low-complexity exploitation with total impact; CISA KEV lists it as actively exploited in the wild; and public exploit code is reported available. EPSS is 2.16% (81st percentile) - modest in absolute terms but well above baseline, and EPSS lags behind confirmed KEV exploitation, so the KEV listing is the dominant signal here. SSVC returns Automatable:yes and Technical Impact:total, both consistent with wormable-style unauthenticated RCE. One internal conflict: the SSVC 'Exploitation: none' value directly contradicts the CISA KEV 'actively exploited' status in the same intelligence set - the KEV determination should be treated as authoritative, and the SSVC exploitation field appears stale/miscoded. The CVSS vector is fully consistent with the description (crafted email → SQL injection → root command execution), so no vector-vs-description mismatch exists. Bottom line: treat as emergency patch, especially given root-level command execution on a security appliance.

An attacker crafts an email message embedding malicious SQL statements and sends it through an affected Cisco Secure Email Gateway; the insufficient validation in the email-parsing logic executes the SQL, which escalates into arbitrary command execution as root on the underlying OS - no authentication or user interaction required. Public exploit code is reported available, and CISA confirms active exploitation in the wild. Because the appliance sits in the mail path and processes attacker-supplied mail by design, the attack surface is exposed by normal operation.