Cisco Secure Email Gateway Vulnerability Exploited in Attacks (CVE-2026-76461)
Cisco Secure Email Gateway flaw CVE-2026-76461 enables root command execution via crafted email SQL injection and is actively exploited, added to CISA KEV.
Cisco disclosed critical vulnerability CVE-2026-76461 in Secure Email Gateway, caused by insufficient validation in email parsing logic, allowing arbitrary SQL statements that lead to root-level command execution. CISA added the flaw to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 17, 2026. The bug affects all SEG deployments regardless of configuration, with fixed releases including 15.5.5-014, 16.0.4-302, and 16.5.0-780. Defenders can check mail_logs for anomalous 'COPY ... TO PROGRAM' SQL statements to detect compromise.
- CVE-2026-76461 actively exploited; CISA KEV patch deadline September 17, 2026
- SQL injection in email parsing leads to root command execution
- Affects ESA, Secure Email Cloud Gateway, and Secure Email Essentials
- Detection: grep mail_logs for anomalous 'COPY ... TO PROGRAM' statements
- Qualys QID 317880 available to identify vulnerable assets
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent. Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts. | 9.8 | 2% | KEV PoC ×2 |
| large≈ tens of thousands of gateway deployments (order of 10,000–50,000 appliances) |
Full article347 words · extracted from threatprotect.qualys.com · click to collapse
Cisco released a security advisory about a critical-severity vulnerability in Cisco Secure Email Gateway. Tracked as CVE-2026-76461, the vulnerability is being exploited in the wild. Successful exploitation of the vulnerability may allow an attacker to execute arbitrary commands with root privileges on the underlying operating system. Cisco TAC team discovered the vulnerability.
CISA acknowledged the active exploitation of the vulnerability by adding to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch it before September 17, 2026.
Cisco Secure Email Gateway (SEG) is a device or software that monitors and protects email from unwanted content, such as spam, phishing attacks, malware, and other fraudulent messages.
Cisco offers multiple SEG products, including:
- Cisco Email Security Appliance (ESA)
- Cisco Secure Email Cloud Gateway
- Cisco Secure Email Essentials
Vulnerability Details
This vulnerability originates from an insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email containing malicious SQL statements via an affected device. Successful exploitation of the vulnerability could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Indicator of Compromises
To verify whether this vulnerability has been exploited, examine the mail_logs for anomalous SQL statements. For devices deployed in a cluster, inspect the logs on every node. The example below illustrates one way a malicious SQL statement might appear in the logs:
cisco-esa> grep -i “COPY.*TO PROGRAM” [IronPort Text Mail Logs Log name – Default: mail_logs]
The presence of any entry in the output may indicate malicious activity.
Affected and Patched Versions
The vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration.
| Cisco AsyncOS for Cisco Secure Email Gateway Software Release | First Fixed Release |
| 15.5 and earlier | 15.5.5-014 |
| 16.0 | 16.0.4-302 |
| 16.5 | 16.5.0-780 |
Note: Cisco strongly recommends users migrate to Release 16.5.0-780.
For more information, please refer to Cisco Security Advisory (cisco-sa-esa-inj-2bLVGmhX).
Qualys Detection
Qualys customers can scan their devices with QID 317880 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
Text extracted automatically; images, tables and formatting may be missing. Original: https://threatprotect.qualys.com/2026/09/15/cisco-secure-email-gateway-vulnerability-exploited-in-attacks-cve-2026-76461/