Critical Cisco Email Gateway Flaw Exploited in the Wild; Patch Immediately
Summary
Cisco says attackers are exploiting CVE-2026-76461, a critical SQL injection in Secure Email Gateway that can enable unauthenticated root command execution. Fixed versions are available; Cisco urges customers to upgrade urgently.
Key points
- CVE-2026-76461 is a critical SQL injection vulnerability in Cisco AsyncOS for Secure Email Gateway, rated CVSS 9.8.
- An unauthenticated remote attacker can reportedly trigger the flaw by sending a specially crafted email, potentially gaining root-level command execution.
- Cisco reported active exploitation, and the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on the day of disclosure.
- Fixed versions are 15.5.5-014, 16.0.4-302, and 16.5.0-780; Cisco recommends upgrading urgently.
- Administrators can review mail_logs on every cluster device for suspicious SQL statements, including entries containing "COPY.*TO PROGRAM".
- The article reports no public proof-of-concept exploit code or attribution for the activity.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- Critical; reported CVSS v3.1 base score 9.8
- Affected Versions
- 15.5 and earlier
- 16.0
- 16.5
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
T1059 · Command and Scripting InterpreterSuccessful exploitation could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges.T1190 · Exploit Public-Facing ApplicationThe vulnerability is exploited remotely through a specially crafted email processed by a vulnerable Cisco Secure Email Gateway.
CVE
Vendors
Products
Cisco AsyncOS Softwarea security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 andCisco Secure Email Gatewayfor CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow anIronPort Email Security ApplianceCisco Secure Email Gateway, formerly known as IronPort Email Security Appliance, is an enterprise email security product that inspects inbound and outbound email for threats including phishing, malware, spam, and