# CISA Adds Actively Exploited Cisco Secure Email Gateway SQL Injection (CVE-2026-76461) to KEV Catalog

> CISA added CVE-2026-76461, a critical (CVSS 9.8) SQL injection in Cisco AsyncOS for Secure Email Gateway, to its KEV Catalog on September 14, 2026 after confirming active exploitation; an unauthenticated attacker can trigger the flaw with a crafted email to gain root-level command execution on the appliance. FCEB remediation is due September 17, 2026 under BOD 26-04.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-15T16:26:01.480Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2508
- **ID:** TL-2026-2508
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UAT-9686 (China)
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76461

## Description

CVE-2026-76461 is a SQL injection vulnerability (CWE-89) in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway (formerly the Cisco Email Security Appliance). Insufficient validation of email content allows an unauthenticated, remote attacker to send a specially crafted email containing malicious SQL statements to an affected device; the injected SQL is used to execute arbitrary operating-system commands with root privileges on the underlying appliance, giving the attacker full control with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8/CRITICAL). Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected by this specific CVE. Cisco published advisory cisco-sa-esa-inj-2bLVGmhX and confirmed evidence of active, in-the-wild exploitation; CISA added the CVE to its Known Exploited Vulnerabilities Catalog the same day (September 14, 2026), triggering a Binding Operational Directive 26-04 remediation deadline of September 17, 2026 for U.S. Federal Civilian Executive Branch agencies, including a requirement to verify whether internet-exposed systems were compromised prior to patching. No workaround exists; Cisco's fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780 (Cisco recommends migrating to 16.5.0-780). Cisco Cloud-hosted Secure Email instances were already patched by the vendor.

This disclosure follows a documented pattern of exploitation against the same appliance family. Cisco Talos assesses with MODERATE confidence that a China-nexus threat actor it tracks as UAT-9686 has been exploiting Cisco Secure Email Gateway and Secure Email and Web Manager appliances since at least late November 2025, publicly disclosed December 10, 2025 alongside Cisco advisory cisco-sa-esa-inj-2bLVGmhX's sibling advisory cisco-sa-sma-attack-N9bf4 (covering the related CVE-2025-20393 Spam Quarantine unauthenticated remote command execution flaw, CVSS 10.0). Talos found overlaps in TTPs, infrastructure, and victimology between UAT-9686 and other China-nexus groups including APT41 and UNC5174. In that campaign, once initial root command execution was obtained on an internet-exposed appliance (Spam Quarantine feature enabled and internet-accessible), the actor deployed a custom lightweight Python backdoor dubbed AquaShell, embedded directly into an existing Python-based web-server file (observed at /data/web/euq_webui/htdocs/index.py), which passively listens for unauthenticated HTTP POST requests carrying encoded commands for shell execution. For remote access and internal pivoting the actor used AquaTunnel, a Golang ELF binary derived from the open-source ReverseSSH project, to establish reverse SSH tunnels, and the open-source tool Chisel for HTTP-based TCP/UDP tunneling to reach internal network segments. To cover its tracks, the actor used AquaPurge, a log-sanitization utility built around egrep-based keyword filtering to strip incriminating entries from appliance logs. Talos and Cisco published IOCs (file hashes and C2 IPs) and Snort rule coverage (SIDs 65617, 65643, 65644, 65645) tied to this campaign. Given the shared vendor, product line, unauthenticated-remote-to-root exploitation pattern, and immediate KEV addition, defenders should treat CVE-2026-76461 exploitation as plausibly connected to the same UAT-9686 campaign infrastructure and tooling, while noting that Cisco's September 14, 2026 advisory and the CISA KEV entry for CVE-2026-76461 do not themselves name an actor. Publicly reported victimology for the UAT-9686 campaign includes government, critical-infrastructure, and telecommunications-sector organizations, with targeting reported in Southeast Asia and Taiwan.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.006 Python
- T1505.003 Web Shell
- T1685.006 Clear Linux or Mac System Logs
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090 Proxy
- T1021.004 SSH
- T1068 Exploitation for Privilege Escalation
- T1070.002 Indicator Removal
- T1552 Unsecured Credentials
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1105 Ingress Tool Transfer
- T1588.006 Obtain Capabilities
- T1587.004 Develop Capabilities
- T1059.004 Command and Scripting Interpreter
- T1562.001 Impair Defenses
- T1114 Email Collection

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Cisco Security Advisory: Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX)
- [Cisco Security Advisory: Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager (cisco-sa-sma-attack-N9bf4)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4)
- [UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager](https://blog.talosintelligence.com/uat-9686/)
- [NVD - CVE-2026-76461](https://nvd.nist.gov/vuln/detail/CVE-2026-76461)
- [BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [BOD 26-04 Implementation Guidance: Forensic Triage Requirements](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- [CVE-2026-76461: Cisco Secure Email SQL Injection (CVSS 9.8)](https://www.strix.ai/cve/CVE-2026-76461)
- [Actively Exploited SQL Injection in Cisco Secure Email Gateway](https://mallory.ai/stories/01a0a18b-f4e7-70bf-8381-4ae7054cbc59)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2508