Cisco disclosed CVE-2026-76461 on September 14, 2026, a critical SQL injection flaw in Cisco Secure Email Gateway that attackers are already exploiting.
The vulnerability carries a CVSS score of 9.8 and can let an unauthenticated remote attacker execute commands with root privileges on an affected appliance.
No login or access to the administrative interface is required. An attacker can target the gateway through the same email-processing path the appliance normally uses to inspect incoming messages, and Cisco says there is no workaround.
How CVE-2026-76461 reaches root privileges
The vulnerability is in the email-parsing logic of Cisco AsyncOS. According to Cisco’s security advisory, insufficient input validation allows a crafted email containing malicious SQL statements to trigger arbitrary SQL execution and ultimately command execution with root privileges on the underlying operating system.
Cisco says its Product Security Incident Response Team became aware of active exploitation in September. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for affected federal civilian agencies.
Rapid7 characterized the activity as zero-day exploitation because attacks had already been observed when the flaw was publicly disclosed.
Cisco found the vulnerability while resolving a Technical Assistance Center support case rather than through a dedicated internal security review.
The flaw is notable because Secure Email Gateway sits directly in the mail path, inspecting inbound and outbound messages for threats such as malware, phishing, and spam. Attackers do not need to reach a separate management service before targeting the vulnerable email-processing logic.
It is also distinct from the Secure Email Gateway RCE exploited earlier this year, which involved CVE-2025-20393 and the Spam Quarantine feature.
Which Cisco Secure Email Gateway versions need patches?
CVE-2026-76461 affects both physical and virtual Cisco Secure Email Gateway appliances regardless of configuration.
Cisco lists these first fixed releases:
-
AsyncOS 15.5 and earlier: 15.5.5-014
-
AsyncOS 16.0: 16.0.4-302
-
AsyncOS 16.5: 16.5.0-780
Cisco strongly recommends migrating to 16.5.0-780.
Secure Email and Web Manager and Secure Web Appliance are not affected by CVE-2026-76461.
Cisco separately published a September security-hardening release for Secure Email Gateway and Secure Email and Web Manager covering multiple internally discovered issues grouped under five CVE IDs. Those findings should not be confused with CVE-2026-76461, which Cisco says was discovered during a customer support case.
Cisco Secure Email Cloud devices have already been upgraded to 16.5.0-780. However, Cisco also says it directly contacted cloud customers whose devices showed evidence of malicious activity, so an updated appliance does not necessarily mean it was never compromised.
How to check Cisco Secure Email Gateway for compromise
Because successful exploitation provides root-level command execution, Cisco warns attackers may remove or conceal evidence stored on the appliance itself.
Administrators should review mail_logs for suspicious SQL statements. Cisco provides the following non-exhaustive search example:
grep -i "COPY.*TO PROGRAM"
Any result may indicate malicious activity, but a clean result does not rule out compromise.
Cisco also recommends checking firewall and network logs outside the affected appliance for unexpected uploads to unfamiliar external IP addresses or downloads from malicious systems.
Maintaining independent log monitoring becomes particularly important when an attacker may have enough privilege to alter evidence locally.
If compromise is suspected on a physical appliance, Cisco recommends contacting Cisco TAC.
For compromised virtual appliances, Cisco advises preserving forensic information before making changes, deploying a new virtual machine on fixed software, rebuilding the configuration, renewing credentials and cryptographic materials, and continuing to monitor for anomalous activity.
Those steps should be handled as an incident response exercise rather than a routine software update.
What security teams should do now
There is no workaround for CVE-2026-76461. Security teams running self-managed Secure Email Gateway appliances should prioritize the fixed software rather than waiting for a normal patch cycle.
Teams should:
-
Inventory physical and virtual Secure Email Gateway appliances and record their AsyncOS versions.
-
Upgrade affected systems to the appropriate fixed release, preferably 16.5.0-780 where supported.
-
Review
mail_logsand external network or firewall telemetry for indicators of attempted exploitation. -
Preserve forensic evidence before rebuilding any appliance suspected of compromise.
-
Rotate credentials and cryptographic material if an attacker may have obtained root access.
-
Restrict appliance management access to trusted hosts and networks.
-
Separate mail and management traffic onto different interfaces where possible.
Cisco has not disclosed how many organizations were compromised or publicly attributed the attacks to a threat actor.
With active exploitation already confirmed, patching stops the known entry point, but organizations also need to determine whether attackers reached an appliance before installing the fix.
Also read: Attackers are also exploiting separate Cisco FMC vulnerabilities to steal credentials, establish tunnels, and deploy ransomware inside enterprise networks.