Source: cisa.gov
A critical SQL injection vulnerability exists in Cisco AsyncOS software for Cisco Secure Email Gateway (SEG). The flaw allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. No authentication is required to exploit this vulnerability, making it particularly dangerous. The vulnerability is tracked as CVE-2026-76461 and has been flagged by CISA under BOD 26-04, which prioritizes security updates based on risk. Organizations using Cisco SEG are urged to apply patches immediately. CISA has also outlined forensic triage requirements for affected systems. The vulnerability is documented in both the NVD and Cisco's official security advisory portal.
