You can trigger a critical SQL injection in Cisco Secure Email Gateway just by sending someone an email. No login, no link to click, no attachment to open. The email itself is the exploit.
CVE-2026-76461 lives in the email-parsing logic of Cisco’s AsyncOS software. A specially crafted email reaching the gateway’s normal parsing path triggers arbitrary SQL execution, and Cisco confirms that successful exploitation can progress from there to OS command execution with root privileges. No authentication is required anywhere in the chain. Cisco became aware of active exploitation in September 2026 and pushed an emergency fix.
The attack surface here is the thing to notice: a mail gateway’s entire job is to accept untrusted email from the entire internet and parse it. That makes a parsing bug in the gateway itself about as close to unauthenticated remote root as this class of device gets. If your organization routes inbound mail through an AsyncOS-based gateway, patching is not optional and there is no practical workaround, since the vulnerable code path is exactly the one the appliance exists to run.
Mail and web gateways are consistently the most exposed, least reviewed boxes in a network, because they are assumed to be “just infrastructure.” Verifying that assumption, before an advisory forces the question, is what our external network penetration testing does.