Cisco Secure Email Gateway Zero-Day Exploited for Root Access
Summary
Cisco confirmed active exploitation of a critical SQL injection in Secure Email Gateway that can give attackers unauthenticated root access via crafted email. Fixed AsyncOS releases are available; Cisco also provided investigation guidance.
Key points
- CVE-2026-76461 is a SQL injection flaw in Cisco AsyncOS email parsing, rated CVSS 9.8.
- A crafted email can trigger exploitation during normal processing; authentication, administrative access, and user interaction are not required.
- Cisco confirmed the flaw was actively exploited before disclosure; CISA added it to its Known Exploited Vulnerabilities Catalog.
- The vulnerability affects physical and virtual Secure Email Gateway appliances regardless of configuration.
- Cisco fixed the issue in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780, and recommends migrating to 16.5.0-780 where feasible.
- Cisco advises checking mail logs and external network and logging data for signs of exploitation, and released indicators of compromise and Snort rules 67109 and 67110.
- Because attackers with root access may alter or remove appliance evidence, Cisco recommends preserving forensic evidence and, where compromise is suspected, rebuilding affected virtual appliances and renewing credentials and cryptographic material.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- Critical; CVSS 9.8
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2025-20393Earlier exploitation of CVE-2025-20393 demonstrates continued threat actor interest in email security infrastructure, which often occupies a trusted position within enterprise environments.CVE-2026-76461The flaw, tracked as CVE-2026-76461, is a Structured Query Language (SQL) injection vulnerability in Cisco AsyncOS email parsing functionality used by Secure Email Gateway.
Vendors
Products
AsyncOSThe flaw, tracked as CVE-2026-76461, is a Structured Query Language (SQL) injection vulnerability in Cisco AsyncOS email parsing functionality used by Secure Email Gateway.Cisco Secure Email GatewayCisco disclosed and patched an actively exploited vulnerability in Cisco Secure Email Gateway that allows a threat actor to gain root-level access to affected appliances.