Critical Cisco Secure Email Gateway Vulnerability Exploited in Attacks

Cisco has disclosed a critical vulnerability in the AsyncOS software for Cisco Secure Email Gateway that is already being leveraged by threat actors in real-world attacks. The flaw has been assigned the identifier CVE-2026-76461 and a CVSS score at the very top of the scale — 9.8 out of 10.

How the attack works

The issue stems from insufficient validation of data in the email-parsing logic. According to Cisco, an unauthenticated remote attacker can send an email with embedded malicious SQL commands. Successful exploitation leads to the execution of arbitrary SQL queries and, from there, to running arbitrary commands with root privileges on the device's operating system.

The vulnerability affects Cisco Secure Email Gateway in both forms — physical and virtual — regardless of configuration. That said, the vendor states that the Secure Email and Web Manager and Secure Web Appliance products are not affected by the issue.

Fixes and workarounds

There are no workarounds: the only means of protection is upgrading to the fixed versions. Cisco has released patches for the 15.5 and earlier branches (build 15.5.5-0141), 16.0 (16.0.4-302), and 16.5 (16.5.0-780).

The vendor reported that it learned of the active exploitation this month but did not disclose the scale of the attacks. Cisco directly notified customers of its Secure Email cloud service on whose devices suspicious activity had been detected.

Indicators of compromise

Cisco recommends reviewing the mail_logs for suspicious SQL queries, and in clusters, checking the logs of each node. To hunt for malicious activity, it suggests running a search for strings of the form COPY...TO PROGRAM in the mail logs; the presence of any such entry may indicate an attack.

The vendor separately warns that, having gained root privileges, attackers may delete or hide traces of their presence. Administrators are therefore advised to cross-check network logs and firewall logs outside the compromised device — looking for unexpected data exfiltration to external addresses or downloads from malicious IPs.

The U.S. agency CISA has already added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal civilian agencies to install the updates by September 17, 2026.

Source: The Hacker News