Cisco Secure Email Gateway SQL injection flaw exploited (CVE-2026-76461)

Cisco Secure Email Gateway has a critical SQL injection flaw, CVE-2026-76461, that lets an unauthenticated remote attacker run commands as root through a crafted email. CISA lists it as exploited in the wild, and its federal due date of 2026-09-17 has long passed, so any unpatched appliance should be treated as a priority incident. This Cisco Secure Email Gateway vulnerability is covered in the Cisco security advisory.

We are covering this now because Cisco updated the advisory on 2026-11-03 (version 1.2, marked Final). The flaw was first published on 2026-09-14, the same day CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.

What happened

The bug sits in the email parsing logic of Cisco AsyncOS, the operating system behind Secure Email Gateway. Cisco says insufficient validation lets an attacker send an email containing malicious SQL statements through an affected device. Successful exploitation allows arbitrary SQL execution, which leads to command execution with root privileges on the underlying operating system.

The weakness is classed as CWE-89 (SQL injection). NVD scores it CVSS 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges and no user interaction.

Am I affected?

Cisco states the flaw affects Secure Email Gateway, both physical and virtual, regardless of device configuration. There is no configuration that avoids it. NVD lists these AsyncOS ranges as affected:

• AsyncOS earlier than 15.5.5-014
• AsyncOS 16.0 up to, but not including, 16.0.4-302
• AsyncOS 16.5 up to, but not including, 16.5.0-780

Cisco confirms that Secure Email and Web Manager and Secure Web Appliance are not affected.

Technical details and exploitation status

• Exploitation: listed in the CISA KEV catalog, added 2026-09-14 with a due date of 2026-09-17. CISA records ransomware campaign use as unknown.
• EPSS: 29.5%, the modelled probability of exploitation activity in the next 30 days.
• Attack path: an inbound or relayed email processed by the gateway, so the attacker needs no account on the device.
• Cloud: Cisco has directly contacted Secure Email Cloud customers whose devices showed malicious activity.

Why this matters

Analysis: a mail gateway is internet-facing by design and sees every message, so a pre-authentication root bug there is about as exposed as it gets. Root access also gives an attacker a position to read or alter mail flow and to pivot into the internal network. Because the flaw is in KEV, patch within hours rather than waiting for a maintenance window, and assume compromise is possible on any device that ran an affected release while exposed.

How to detect exploitation

Cisco advises reviewing the mail_logs for suspicious SQL statements, on every device if the gateways are clustered. Its non-exhaustive example search is:

grep -i "COPY.*TO PROGRAM"

run against the IronPort Text Mail Logs (the default mail_logs log). Any match may indicate malicious activity. Cisco warns that root access lets attackers remove or hide evidence, so a clean result on the device is not proof of safety. It recommends cross-checking network and firewall logs outside the appliance, including for unexpected uploads from the gateway to external IP addresses. Administrators of Secure Email Cloud without CLI access may not be able to run these checks themselves.

What to do

1. Upgrade AsyncOS to a fixed release: 15.5.5-014, 16.0.4-302 or 16.5.0-780, according to your release branch.
2. Do not rely on mitigation. Cisco states there are no workarounds.
3. Search mail_logs on every gateway for the pattern above, and review firewall and network logs for unusual outbound transfers from the appliance.
4. If you find signs of exploitation, treat the appliance as fully compromised: isolate it, preserve evidence, and rotate credentials and keys that were stored on or reachable from it.
5. Check that gateways are not needlessly exposed, and tell your incident response team and mail administrators that the KEV deadline has passed.

Cisco has not published details of who is exploiting the flaw or how many devices are affected.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• Cisco Secure Email Gateway path traversal added to CISA KEV (CVE-2026-76519)
• Cisco UCS UEFI Shell Secure Boot Bypass (CVE-2026-20293)
• Cisco Nexus 9000 ACI contract bypass flaw fixed (CVE-2026-20038)

Sources

• Cisco Security Advisory: Secure Email Gateway SQL Injection Vulnerability
• NVD: CVE-2026-76461
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-76461
• FIRST EPSS score for CVE-2026-76461