Our automated tracking framework flagged that CISA added CVE-2026-76461 (Cisco Secure Email Gateway) to the Known Exploited Vulnerabilities (KEV) catalog on September 15, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-76461 by September 17, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-76461 |
| Vendor / product | Cisco Secure Email Gateway |
| Vulnerability | Cisco Secure Email Gateway SQL Injection Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | September 14, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | September 17, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Cisco currently ranks #8 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 98 |
| Median lag (public → KEV listing) | 1189 days |
| 0-day rate (exploited at or before disclosure) | 15% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1710 tracked KEV entries is 252 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | September 9, 2026 | 189 | No |
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | August 11, 2026 | 0 | No |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | July 29, 2026 | 0 | No |
| CVE-2008-4128 | IOS | July 13, 2026 | 6507 | No |
| CVE-2026-20230 | Unified Communications Manager | June 25, 2026 | 22 | No |
Defense guide: How to Detect SQL Injection: Attack Chain & Defense (2026) — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-76461, a SQL Injection vulnerability in Cisco Secure Email Gateway with a CVSS base score of 9.8, to its Known Exploited Vulnerabilities (KEV) catalog. The KEV listing on September 14, 2026, with a federal patch deadline of September 17, 2026, signals extreme urgency. This vulnerability was added to the KEV catalog the same day it was made public, indicating active exploitation was identified almost immediately. All organizations must prioritize patching within the next three days.
Organizations using Cisco Secure Email Gateway are highly exposed. Patch before the September 17, 2026 deadline. If patching cannot be completed by then, implement compensating controls. These should include network segmentation to isolate the affected gateway and enhanced monitoring for unusual database queries or outbound connections. Review access controls to the gateway and related systems to limit potential lateral movement by attackers.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Cisco’s CVE-2026-20349 Was Exploited in 0 Days — Well Under Its 1245-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
