CVE-2026-76461 is a SQL injection in Cisco Secure Email Gateway, CVSS 9.8, added to the CISA Known Exploited Vulnerabilities catalog on September 14. Cisco's own advisory language is "urges urgent patch," which is the kind of phrase that survives a legal review and tells a defender nothing about the clock. The EPSS score on this one sits at 2%, low predicted near-term exploitation volume, but that number describes mass scanning behavior, not what a single motivated operator does with a root-level injection into a mail gateway that already sits on the internet by design.

The mechanism is unglamorous, which is the point. Email gateways parse untrusted input from the open internet as their entire job description, so a SQL injection there does not need a phishing lure or a stolen credential to reach the box. Root access on the gateway means the attacker sees every message the appliance relays, which for a bank branch or a claims processor is the mail server most likely to be sitting between "unauthenticated" and "everyone's inbox." The seven-second SSH bastion compromise Sysdig published this week and this bug share the same lesson: the perimeter appliance is now the fastest path in, not the slowest.

Cisco Secure Email Gateway is the named product, and CISA's KEV listing is the only artifact that matters here, since it confirms exploitation is not theoretical. The patch exists. The gap is between "urgent" as adjective and "urgent" as a number of hours, and Cisco has supplied the former.