CVE-2026-76461Discovered Published
Cisco Secure Email Gateway: SQL injection during email parsing (CVE-2026-76461)
Advisory record · Vendor advisory
Status. Two-tier request-filter comparison against Eden 1.103.0 using a synthetic HTTP fixture.
The vulnerability
Cisco reports that SQL in a crafted email can reach AsyncOS email parsing and lead to root-level command execution.
The Eden patch
Tier 1 — declarative policy. Deny all requests under the fixture prefix /api/emails, including benign requests.
Tier 2 — native Rust module. Match /api/emails/search and refuse requests containing a configured marker in the body.
Measured comparison (2026-11-12 UTC)
| Configuration | Benign request | Attack fixture |
|---|---|---|
| Baseline | HTTP 200 | HTTP 200, backend marker recorded |
| Tier 1 route deny | HTTP 403 | HTTP 403 |
| Tier 2 native module | HTTP 200 | HTTP 403, backend marker absent |
Signed module authority
The module was imported for explicit activation. All expected shards acknowledged activation. Reader inspection, a tampered statement and an invalid signature were rejected. After revocation the same request received HTTP 503. Re-approval and reactivation restored HTTP 403.
Test scope
The fixture tests SQL markers in a synthetic HTTP email-search request. Cisco's advisory describes crafted email delivery and parsing, which remain outside this module's tested scope.
The measurements cover the supplied fixture probes. Alternate routes, encodings, and other bypasses remain untested.