Cisco Secure Email Gateway CVE-2026-76461: Fixed AsyncOS Versions and Exploitation Checks

By AiCybr Editorial · Published September 16, 2026

Cisco has patched CVE-2026-76461, a critical SQL-injection vulnerability in AsyncOS for Cisco Secure Email Gateway that the company says is under active exploitation. The flaw carries a CVSS 3.1 score of 9.8 and can allow an unauthenticated remote attacker to execute commands with root privileges by sending a crafted email through an affected gateway.

Cisco published its advisory on September 14, 2026. The vulnerability affects physical and virtual Secure Email Gateway appliances regardless of configuration. The first fixed releases are 15.5.5-014, 16.0.4-302 and 16.5.0-780, depending on the installed AsyncOS train. Cisco recommends migration to 16.5.0-780 where supported.

CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14. Federal Civilian Executive Branch agencies have a September 17, 2026 remediation deadline. Cisco provides no workaround for the vulnerability, making an upgrade to a fixed release the primary remediation step.

Fixed AsyncOS releases

Cisco states that Secure Email and Web Manager and Secure Web Appliance are unaffected by CVE-2026-76461. Cisco Secure Email Cloud devices have already been upgraded by Cisco to 16.5.0-780.

Administrators can upgrade through System Administration → System Upgrade in the web interface or use the CLI upgrade command followed by DOWNLOADINSTALL. The appliance reboots after the upgrade.

How CVE-2026-76461 reaches root command execution

Cisco attributes the vulnerability to insufficient validation in Secure Email Gateway's email-parsing logic. A crafted message can contain malicious SQL statements that are processed by an affected device. Successful exploitation permits arbitrary SQL execution, which can lead to operating-system command execution as root.

The attack path requires neither authentication nor access to the administrative interface. The vulnerable function is part of normal email processing, so patch prioritization should cover every affected physical and virtual gateway that processes mail.

Cisco says its Product Security Incident Response Team became aware of active exploitation in September 2026. The vulnerability was identified while Cisco was resolving a Technical Assistance Center support case.

Check mail_logs for exploitation attempts

Cisco advises administrators to review mail_logs for suspicious SQL statements. For clustered deployments, logs should be checked on every cluster member. Cisco gives the following non-exhaustive search example:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

Cisco says any returned entry may indicate malicious activity. The advisory also links Snort rules 67109-67110 as detection resources.

Root-level access can allow an attacker to remove or conceal evidence on the gateway. Cisco therefore recommends correlating appliance findings with network and firewall logs stored outside the affected device, including unexpected uploads from the gateway to external IP addresses and downloads from suspicious infrastructure.

What to do if compromise is suspected

Cisco's recovery guidance differs for physical and virtual appliances. For a physical Secure Email Gateway, Cisco recommends contacting Cisco TAC for assistance.

For a virtual appliance, Cisco recommends preserving forensic information before making changes, deploying a new virtual machine on a fixed AsyncOS release, rebuilding the product configuration, renewing credentials and cryptographic material installed on the appliance, and continuing to monitor for anomalous activity.

Cisco says it directly contacted Secure Email Cloud customers whose devices showed malicious activity. It has already upgraded the cloud fleet to 16.5.0-780 and is conducting remediation and recovery work for affected customers.

Patch priority

CVE-2026-76461 combines a network-reachable, unauthenticated attack path with root-level command execution and confirmed exploitation. Organizations operating affected Secure Email Gateway appliances should move to a fixed AsyncOS release and review historical telemetry for signs of compromise, with the Cisco advisory serving as the authority for supported upgrade paths.

For U.S. federal civilian agencies, the CISA KEV deadline is September 17, 2026. Other operators can use the same short remediation window as a useful prioritization signal because Cisco has already confirmed exploitation in real environments.

Sources

• Cisco Security Advisory: Cisco Secure Email Gateway SQL Injection Vulnerability, advisory cisco-sa-esa-inj-2bLVGmhX, September 14, 2026.
• CISA Known Exploited Vulnerabilities Catalog and September 14, 2026 KEV alert for CVE-2026-76461.
• Rapid7: CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild, September 15, 2026.