Description
This module exploits an unauthenticated SQL injection in Cisco Secure Email Gateway S/MIME certificate harvesting. A sender-controlled email address in a signing certificate is used in a PostgreSQL query without escaping. The module sends one signed email whose certificate supplies enough addresses to flush the asynchronous database writer, stacks COPY TO PROGRAM, and runs a payload as root through AsyncOS runas and Python.
The check identifies the product through Cisco SEG's hidden SMTP queue-status command. AsyncOS does not expose a version through a benign SMTP command, so the check can only identify the product but not if it is explicitly vulnerable. Public-key harvesting must be enabled on the inbound mail flow policy for the target to be exploitable.
The Cisco advisory is vague so attributing this vulnerability to a specific CVE is not obvious, but this appears to be CVE-2026-76443 rather than CVE-2026-76461 based on the IOCs available for CVE-2026-76461.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/unix/smtp/cisco/secure_email_gateway_smime_sqli_rcemsf undefined(secure_email_gateway_smime_sqli_rce) > show actions ...actions...msf undefined(secure_email_gateway_smime_sqli_rce) > set ACTION < action-name >msf undefined(secure_email_gateway_smime_sqli_rce) > show options ...show and set options...msf undefined(secure_email_gateway_smime_sqli_rce) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub