Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root
Cisco patched critical unauthenticated SQL injection CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway enabling root command execution, with malicious activity already detected.
Cisco disclosed CVE-2026-76461, a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway appliances running AsyncOS, letting unauthenticated remote attackers execute arbitrary commands as root via crafted emails containing malicious SQL statements. Cisco detected malicious activity and directly contacted Secure Email Cloud customers, indicating active exploitation. No workaround exists; fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with migration to 16.5.0-780 advised. Secure Email and Web Manager and Secure Web Appliance are not affected.
- CVE-2026-76461 scores CVSS 9.8; unauthenticated SQL injection yields root command execution
- Flaw stems from insufficient validation in email parsing logic; crafted emails trigger it
- Cisco detected malicious activity and contacted Secure Email Cloud customers directly
- No workaround; upgrade to AsyncOS 15.5.5-0141, 16.0.4-3021, or 16.5.0-780
- Hunt IronPort mail logs for 'COPY ... TO PROGRAM' SQL patterns across clustered devices
- CVEs
- CVE-2026-76461
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 40% | KEVPoC ×3 | KEV |
From the original article
2 min read at gbhackers.com
Cisco has released security updates to address a critical SQL injection vulnerability in the Cisco Secure Email Gateway. This vulnerability can be exploited remotely and without authentication, allowing attackers to execute arbitrary commands with root privileges on affected devices. Tracked as CVE-2026-76461, this flaw has a CVSS base score of 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.