Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw

Cisco has confirmed active exploitation of CVE-2026-76461, a critical SQL injection vulnerability in the email-parsing logic of AsyncOS Software for Cisco Secure Email Gateway. Rated CVSS 9.8 and classified as CWE-89, the flaw can be exploited remotely without authentication or user interaction by sending a specially crafted email containing malicious SQL statements. Successful attacks may lead to arbitrary SQL execution and, ultimately, operating-system command execution with root privileges.

Cisco became aware of exploitation in September 2026 while handling a TAC support case, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 14 September 2026, with a stated patching deadline of 17 September.

The issue affects physical and virtual Secure Email Gateway appliances regardless of configuration. Cisco lists 15.5.5-014 as the first fixed release for AsyncOS 15.5 and earlier, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5, recommending migration to 16.5.0-780 where possible. Secure Email and Web Manager and Secure Web Appliance are not affected, and Cisco says there is no workaround.

Administrators should review `mail_logs` on every appliance and cluster node for suspicious SQL activity, including `COPY…TO PROGRAM` entries, and compare findings with firewall and network telemetry because attackers may hide evidence on the gateway. Cisco has released Snort rules 67109 and 67110.

Suspected compromise should be treated as an incident: Cisco recommends contacting TAC for physical appliances, while virtual appliance owners should preserve forensic data before redeployment, then rebuild using fixed software and renew credentials and cryptographic material.