Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root
Cisco patched critical unauthenticated SQL injection CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway enabling root command execution, with malicious activity already detected.
Cisco disclosed CVE-2026-76461, a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway appliances running AsyncOS, letting unauthenticated remote attackers execute arbitrary commands as root via crafted emails containing malicious SQL statements. Cisco detected malicious activity and directly contacted Secure Email Cloud customers, indicating active exploitation. No workaround exists; fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with migration to 16.5.0-780 advised. Secure Email and Web Manager and Secure Web Appliance are not affected.
- CVE-2026-76461 scores CVSS 9.8; unauthenticated SQL injection yields root command execution
- Flaw stems from insufficient validation in email parsing logic; crafted emails trigger it
- Cisco detected malicious activity and contacted Secure Email Cloud customers directly
- No workaround; upgrade to AsyncOS 15.5.5-0141, 16.0.4-3021, or 16.5.0-780
- Hunt IronPort mail logs for 'COPY ... TO PROGRAM' SQL patterns across clustered devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent. Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts. | 9.8 | 2% | KEV PoC ×2 |
| large≈ tens of thousands of gateway deployments (order of 10,000–50,000 appliances) |
Full article562 words · extracted from gbhackers.com · click to collapse
Cisco has released security updates to address a critical SQL injection vulnerability in the Cisco Secure Email Gateway. This vulnerability can be exploited remotely and without authentication, allowing attackers to execute arbitrary commands with root privileges on affected devices.
Tracked as CVE-2026-76461, this flaw has a CVSS base score of 9.8 out of 10. It affects Cisco AsyncOS Software running on both physical and virtual Cisco Secure Email Gateway devices.
Cisco disclosed the issue on September 14, warning that all vulnerable gateway deployments are at risk, regardless of their configuration.
Cisco Secure Email Gateway Flaw
The vulnerability, identified by Cisco bug ID CSCwu56234, arises from insufficient validation in the product’s email parsing logic. An attacker can send a specially crafted email containing malicious SQL statements to an exposed Cisco Secure Email Gateway appliance.
If successfully exploited, this SQL injection could allow the attacker to execute arbitrary SQL commands and gain root-level access to the underlying operating system.
According to Cisco’s security advisory, “An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device.”
Root-level command execution poses a severe risk to organizations, as it could provide attackers with complete control over the compromised email security appliance.
A compromised gateway may allow threat actors to alter configurations, access stored data, establish persistence, turn off security controls, or use the device as a staging point for attacks against internal infrastructure.
Cisco confirmed that the vulnerability affects Cisco Secure Email Gateway appliances, including both physical and virtual instances. However, Cisco Secure Email and Web Manager as well as Secure Web Appliance products are not vulnerable to CVE-2026-76461.
Cisco has not provided a workaround for this SQL injection vulnerability and strongly recommends that administrators upgrade to a fixed AsyncOS release as soon as possible. The following Cisco AsyncOS releases contain fixes:
Cisco AsyncOS release: First fixed release
- 15.5 and earlier: 15.5.5-0141
- 16.0: 16.0.4-3021
- 16.5: 16.5.0-780
Cisco advises customers to migrate to AsyncOS Release 16.5.0-780 where possible. Administrators can apply the updates through the appliance’s web-based management interface by navigating to System Administration > System Upgrade, selecting Upgrade Options, and choosing Download and Install.
Cisco recommends that administrators review mail logs for suspicious SQL statements that could indicate exploitation attempts. Organizations can search IronPort text mail logs for SQL commands involving “COPY … TO PROGRAM” using the following command:
grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]Any matching entries may suggest potentially malicious activity, though Cisco notes that this detection pattern is not exhaustive. Organizations operating clustered Secure Email Gateway deployments should inspect logs on all cluster devices.
Cisco has also warned that threat actors with root access may delete, modify, or conceal evidence on the compromised appliance.
Administrators should review external telemetry, including firewall and network logs, for suspicious outbound connections, unexpected uploads to external IP addresses, or downloads the gateway initiates from malicious sources.
Cisco Secure Email Cloud customers without command-line access may find it challenging to perform these checks independently. Cisco has contacted cloud customers directly when it detected malicious activity.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/hackers-exploit-critical-cisco-secure-email-gateway-flaw/