API
< Back to all clusters
[TECHNOLOGY] · United States · 67 sources

started · updated

Cisco patches critical zero-day SQL injection vulnerability

Cisco has released urgent patches to address CVE-2026-76461, a critical zero-day SQL injection vulnerability affecting Cisco Secure Email Gateway appliances running AsyncOS Software. The flaw, which carries a CVSS score of 9.8, allows unauthenticated remote attackers to achieve root-level Remote Code Execution (RCE) by sending a specially crafted inbound email.

The vulnerability stems from insufficient validation within the email parsing logic. Successful exploitation enables complete system compromise, allowing attackers to intercept, read, or modify all organizational email traffic. Cisco confirmed that the vulnerability has been actively exploited in the wild.

In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to remediate affected systems. Organizations are advised to audit mail logs for suspicious SQL statements and apply the available security updates immediately.

Entities

Anthropic · AsyncOS · CISA · CVE-2026-76461 · Cisco · Cisco Secure Email Gateway · Gartner · OpenAI · Sonar · Verizon

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

a bad tool always blames the workman [backofmind.substack.com]
写文档的人为什么开始造系统?ZStack 的 AI Native 内容工程实践_天极网 [news.yesky.com]
They Look Human… But They Aren’t [ufosightingshotspot.blogspot.com]
Cheap attacks, costly lessons [jerseyeveningpost.com]