Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Cisco Email Gateway Flaw Exploited to Gain Root Access via Email

Part of the CVE-2026-76461 story · since 14 Sep

Quiet for 2 weekslast report 15 Oct10 articles7 outlets
14 Sep · CISA first1 Oct9 Oct17 OctNowThis article2nd of 10
  • Mon 14 Sep, 20:32 UTC. CISA, first report. CISA Warns of Actively Exploited Cisco Email Gateway Flaw. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 04:41 UTC. SecurityOnline, its first report on the story. Cisco Email Gateway Flaw Exploited to Gain Root Access via Email. Cites a CVE in CISA KEV. This article, 2nd of 10.
  • Tue 15 Sep, 05:52 UTC. SecurityWeek, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Rapid7, its first report on the story. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 21:21 UTC. Security Affairs. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:51 UTC. SOCRadar, its first report on the story. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 19:26 UTC. The Hacker News, its first report on the story. Cisco Email Gateway Flaw Exploited to Run Commands as Root. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 07:01 UTC. SecurityWeek. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access. Cites a CVE in CISA KEV.

Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway, tracked as CVE-2026-76461 and rated 9.8 (Critical) under CVSSv3. The flaw affects both physical and virtual appliances, regardless of configuration. It is caused by insufficient validation in AsyncOS email-parsing logic, allowing an unauthenticated attacker to send a specially crafted email containing malicious SQL statements.

Successful exploitation can result in command execution with root privileges on the underlying operating system, without user interaction. Cisco said it became aware of attacks in September 2026, while CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue.

Affected versions include 14.0.0-698, 13.5.1-277, 13.0.0-392, 14.2.0-620, 13.0.5-007 and 13.5.4-038, among others. Cisco says the issue does not affect Secure Web Appliance or Secure Email and Web Manager. It has been fixed in AsyncOS releases 15.5.5-014, 16.0.4-3021 and 16.5.0-780; the article’s table lists 16.0.4-302 as the first fixed release, so administrators should consult Cisco’s advisory when selecting an update. There is no workaround.

Administrators should upgrade promptly, review mail_logs for suspicious SQL statements, and compare them with external network and firewall logs because attackers with root access may alter local evidence.

How the story developed

All 10 articles
Quiet for 2 weekslast report 15 Oct10 articles7 outlets

10 articles from 7 outlets since 14 Sep. Quiet since 15 Oct. This was the 2nd report, 8 hours after the first.

Now14 Sep171819202115 OctFirst reportCISA · 14 Sep, 20:32This article2nd of 10 · day 1
  • Mon 14 Sep, 20:32 UTC. CISA, first report. CISA Warns of Actively Exploited Cisco Email Gateway Flaw. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 04:41 UTC. SecurityOnline, its first report on the story. Cisco Email Gateway Flaw Exploited to Gain Root Access via Email. Cites a CVE in CISA KEV. This article, 2nd of 10.
  • Tue 15 Sep, 05:52 UTC. SecurityWeek, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Rapid7, its first report on the story. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 21:21 UTC. Security Affairs. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:51 UTC. SOCRadar, its first report on the story. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 19:26 UTC. The Hacker News, its first report on the story. Cisco Email Gateway Flaw Exploited to Run Commands as Root. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 07:01 UTC. SecurityWeek. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Mon 14 SepDay 01
    1. CISA Warns of Actively Exploited Cisco Email Gateway Flaw20:32 · CISA · official · First report · CISA alert · Known exploited CVE
  2. Tue 15 SepDay 15
    1. Cisco Email Gateway Flaw Exploited to Gain Root Access via Email04:41 · SecurityOnline · Known exploited CVE · This article, 2nd of 10
    2. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw05:52 · SecurityWeek · Known exploited CVE
    3. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day13:13 · Security Affairs · Known exploited CVE
    Show 2 more from 15 Sep
    1. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely13:13 · Rapid7 · Known exploited CVE
    2. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks21:21 · Security Affairs · Known exploited CVE
  3. Wed 16 SepDay 21
    1. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw14:51 · SOCRadar · Known exploited CVE

  4. Quiet for 5 days

    Mon 21 SepDay 71
    1. Cisco Warns of Actively Exploited Flaws Enabling Root Access02:59 · SecurityOnline · Picked up again · Known exploited CVE

  5. Quiet for 3 weeks

    Wed 14 OctDay 301
    1. Cisco Email Gateway Flaw Exploited to Run Commands as Root19:26 · The Hacker News · Picked up again · Known exploited CVE
  6. Thu 15 OctDay 311
    1. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access07:01 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in