Cisco Secure Email Gateway CVE-2026-76461 Exploited

CVE-2026-76461 is a CVSS 9.8 SQL injection flaw in the email parsing logic of Cisco Secure Email Gateway (AsyncOS) that lets an unauthenticated, remote attacker run commands as root on the underlying OS simply by sending a crafted email. It is actively exploited and was added to the CISA Known Exploited Vulnerabilities catalog on September 14, 2026 with a federal patch deadline of September 17, so upgrade to a fixed AsyncOS build immediately.

Cisco confirmed active exploitation of the flaw in its Secure Email Gateway, the appliance many organizations put in front of their mail flow to filter spam, phishing, and malware. The irony is hard to miss: the device meant to inspect inbound email is compromised by inbound email. According to BleepingComputer and The Hacker News, a successful exploit gives an attacker arbitrary command execution with root privileges, the highest level of control on the appliance, with no authentication and no user interaction required.

The mechanism is a classic SQL injection (CWE-89) reached through insufficient validation in how AsyncOS parses messages. An attacker embeds malicious SQL statements in a crafted email; when the gateway processes the message, those statements are executed against the backend, and the chain ends in operating-system command execution as root. Because the trigger is an ordinary-looking email delivered to a device whose entire job is to accept email, there is no perimeter to hide behind. Cisco said it has contacted affected cloud customers directly, per its security advisory.

What is CVE-2026-76461 and how does the attack work?

CVE-2026-76461 is an unauthenticated remote code execution vulnerability rooted in a SQL injection weakness in the AsyncOS email parser. The attacker does not need credentials, a foothold, or a phishing victim to click anything. They send a message containing SQL payloads, the parser fails to sanitize the input, and the injected statements run with enough privilege to reach the operating system as root. That combination, network-reachable, no authentication, low attack complexity, and full compromise, is exactly why it carries a CVSS score of 9.8 out of 10.

Which Cisco Secure Email Gateway versions are affected and fixed?

The flaw affects physical and virtual Secure Email Gateway deployments running vulnerable AsyncOS releases. Cisco has published fixed builds for each supported train.

There is no configuration workaround; applying the fixed AsyncOS version is the remediation. Because this is an appliance sitting in the mail path, patching should be treated as an emergency change, not a scheduled one.

Is CVE-2026-76461 being actively exploited?

Yes. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14, 2026 and set a remediation due date of September 17, 2026, and Cisco has confirmed exploitation in the wild. The EPSS model already places it around the 81st percentile for exploitation likelihood. When a vulnerability is unauthenticated, network-reachable, and confirmed exploited, waiting for a maintenance window is itself the risk.

Our read

An email gateway is a security control, and this is a reminder that security controls are attack surface too. Assuming a device "is working" because it is deployed and patched-on-paper is exactly the gap that active exploitation exposes. The honest question is not whether you own a Secure Email Gateway but whether you can prove, today, which of your appliances are on a fixed AsyncOS build and which crafted messages your logs would actually surface. That is a continuous-verification problem, and it maps to how we think about supervised adversary simulation: exercise the control the way an attacker would, then confirm the fix landed rather than assuming it did. In our analysis of the 2025 KEV catalog, roughly two in three actively exploited flaws would have been missed by an annual pentest; a three-day CISA deadline on a root-level, unauthenticated bug is that pattern in miniature.

Reporting by BleepingComputer and The Hacker News; CVSS, CWE-89, and KEV status per Cisco advisory cisco-sa-esa-inj-2bLVGmhX and the CISA KEV catalog. Sources linked above.

Frequently asked questions

What is CVE-2026-76461?
It is a CVSS 9.8 SQL injection vulnerability in the email parsing logic of Cisco Secure Email Gateway (AsyncOS) that allows an unauthenticated, remote attacker to execute arbitrary commands as root by sending a specially crafted email.

How do I fix CVE-2026-76461?
Upgrade AsyncOS to a fixed build: 15.5.5-0141 for 15.5 and earlier, 16.0.4-302 for the 16.0 train, or 16.5.0-780 for 16.5. There is no configuration-only workaround.

Is CVE-2026-76461 being exploited in the wild?
Yes. Cisco confirmed active exploitation and CISA added it to the Known Exploited Vulnerabilities catalog on September 14, 2026, with a patch deadline of September 17, 2026.

Does the attacker need credentials or user interaction?
No. The exploit is unauthenticated and requires no user interaction; a single crafted email delivered to the appliance is enough.