CVE-2026-76461: Cisco Email Gateway Flaw Exploited

Cisco has confirmed active exploitation of CVE-2026-76461, a critical SQL injection vulnerability in Cisco Secure Email Gateway that can lead to operating-system command execution with root privileges.

Cisco disclosed the vulnerability on September 14, 2026, after its Product Security Incident Response Team (PSIRT) became aware of exploitation. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalog the same day.

What Is CVE-2026-76461?

CVE-2026-76461 (CVSS 9.8) is an SQL injection vulnerability, classified as CWE-89, in the email-parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway.

The vulnerability results from insufficient validation during email parsing. According to Cisco, an unauthenticated remote attacker can exploit it by sending a crafted email containing malicious SQL statements through an affected gateway. Successful exploitation can lead to arbitrary SQL execution and ultimately command execution with root privileges on the underlying operating system.

No authentication or user interaction is required. Unlike vulnerabilities confined to administrative interfaces, this flaw is reachable through the appliance’s email-processing functionality.

Which Cisco Secure Email Gateway Versions Are Affected?

CVE-2026-76461 affects both physical and virtual Cisco Secure Email Gateway appliances regardless of device configuration. Cisco identifies the following first fixed releases:

Cisco strongly recommends migrating to AsyncOS 16.5.0-780 where possible. Cisco has already upgraded Secure Email Cloud devices to that release.

Cisco Secure Email and Web Manager and Secure Web Appliance are not affected by CVE-2026-76461.

Why Is CVE-2026-76461 Critical?

Successful exploitation can provide an attacker with root-level command execution on a Secure Email Gateway.

This level of access could allow an attacker to modify appliance configurations, access information stored on the system, establish persistence, or use the compromised gateway for further activity.

Root access also creates an important incident response problem: Cisco warns that attackers may remove or hide evidence of exploitation. Defenders should therefore correlate appliance logs with external firewall and network telemetry rather than relying exclusively on evidence stored on the gateway.

Is CVE-2026-76461 Actively Exploited?

Yes. Cisco PSIRT confirmed that it became aware of active exploitation in September 2026 while resolving a Cisco TAC support case. CISA also added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) list, establishing a patching deadline of September 17, 2026.

The SOCRadar Cyber Threat Intelligence module continuously tracks emerging threats for new exploitation patterns, updated remediation steps, and broader threat context, while Attack Surface Management proactively identifies vulnerable appliance instances across your perimeter. This comprehensive visibility ensures your organization stays protected against critical flaws like CVE-2026-76461.

What Should Defenders Do About CVE-2026-76461?

Patch Affected Secure Email Gateways

Organizations should upgrade affected appliances to the appropriate fixed AsyncOS release. Cisco states that no workaround addresses CVE-2026-76461, making the software update the primary remediation.

Administrators should consult the Cisco Security Advisory for CVE-2026-76461 for current fixed-version and recovery guidance.

Every physical, virtual, and clustered Secure Email Gateway should be included in the assessment. Patching prevents future exploitation through the known vulnerability but does not establish that an appliance was not compromised before the update.

Check Cisco’s Indicators of Compromise

Cisco recommends reviewing mail_logs for suspicious SQL statements on every appliance, including each node in a cluster. Cisco specifically identifies entries matching suspicious COPY…TO PROGRAM behavior as a potential indication of malicious activity.

A matching entry may indicate exploitation but should be investigated alongside surrounding activity. Cisco also recommends checking external network and firewall logs for suspicious connections, including unexpected uploads from the appliance or downloads from malicious infrastructure.

Cisco has released Snort rules 67109 and 67110 for CVE-2026-76461.

Treat Suspected Exploitation as an Incident

For suspected compromise of a physical appliance, Cisco recommends contacting Cisco TAC.

For virtual appliances, Cisco recommends preserving forensic information before redeployment, as replacing the instance destroys local configurations and logs. Organizations should then deploy a new virtual machine running fixed software, rebuild the configuration, renew credentials and cryptographic material, and continue monitoring for anomalous activity.

Cisco also recommends separating mail and management functionality onto different interfaces where possible, restricting administrative access, placing appliances behind filtering controls, and forwarding logs to an external system for longer-term retention.

Because CVE-2026-76461 is already being exploited, organizations should prioritize both remediation and compromise assessment. Updating an appliance closes the known vulnerable path, but systems exposed before patching still warrant investigation for suspicious SQL activity, unexpected network connections, configuration changes, and other signs of post-exploitation behavior.