Cisco Secure Email Gateway is at the center of a critical case, as CVE-2026-76461 is actively exploited to execute root commands. The vulnerability does not require authentication and can be triggered through a specially crafted email message.
Cisco released the initial security update on September 14 and updated it three days later. The company says that the Product Security Incident Response Team (PSIRT) has been aware of an active exploit since September, and there is no workaround available.
See also: Cisco ISE: Critical vulnerability under active exploitation
The security of Cisco Secure Email Gateway
CVE -2026-76461 is a SQL injection vulnerability in the message parsing logic of AsyncOS. According to the NVD entry, it has a CVSS score of 9.8 and is rated critical. Cisco's assessment uses the AV:N/AC:L/PR:N/UI:N attributes, meaning a low-complexity network attack without privileges or user interaction.
A remote attacker can send a specially crafted message via a vulnerable device, embedding malicious SQL commands. Insufficient input validation allows the execution of arbitrary queries and, ultimately, commands on the underlying operating system with root privileges.
The attack does not require access to the management interface or a valid account. This significantly increases the risk for devices that receive external mail, as the malicious message follows the same path as a regular email. Cisco notes that both physical and virtual devices are affected, regardless of their configuration.
Active exploitation on email devices
The active exploit report differentiates the incident from a typical proactive update. Cisco says it detected malicious activity on Secure Email Cloud devices and contacted customers directly when it found signs of a potential breach. It has not disclosed the extent of the attacks or the identities of the perpetrators.
Independent coverage by The Hacker News confirms that the issue has been added to CISA’s Known Exploited Vulnerabilities list. The inclusion is not in itself technical proof of any individual attack, but it does indicate that organizations should prioritize remediation and auditing for previous malicious activity.
See also: Critical vulnerability in WSO2 API Manager actively exploited
Fixed versions and log checking
For AsyncOS 15.5 and earlier, Cisco has patch 15.5.5-014. For branch 16.0, version 16.0.4-302, while for 16.5, version 16.5.0-780. The company recommends that those using an older branch move to the latest supported version.
Administrators should review the mail_logs on each device, even when the Secure Email Gateway is running in a cluster. Cisco recommends looking for suspicious SQL commands, including the phrase “COPY.*TO PROGRAM”. Its presence alone does not prove a successful compromise, but it is an indication that immediate investigation is needed.
Because a root-privileged attacker can delete or hide traces, the audit should not be limited to the device. The SecNews technical team recommends comparing logs from firewalls, network servers, and external event collection systems. Pay particular attention to unexpected uploads to unknown addresses and unusual downloads from the Internet.
If evidence of exploitation is found, the installation of the patch should be accompanied by an incident response process. Isolating the device, maintaining copies of external logs, and reinstalling from a trusted image may be necessary, depending on the findings of the investigation.
See also: Microsoft zero-day: Two Windows vulnerabilities actively exploited
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Immediate priority for CVE-2026-76461
The absence of a workaround means that mail filters or network rules should not be considered sufficient protection. Organizations using Cisco Secure Email Gateway should note the AsyncOS version, plan for an immediate upgrade, and review logs before and after the change.
At the same time, security teams need to confirm whether devices communicate with an external logging system and whether data is retained for a sufficient period of time. Sending events off-device reduces the risk of data loss after potentially gaining privileged access. Recording the exact version, upgrade time, and related findings facilitates both technical investigation and management notification.
CVE-2026-76461 combines zero access requirements, active exploitation, and the ability to execute commands as root. Therefore, a fix should not wait for the next maintenance cycle, especially in gateways that process messages from the Internet.
