Actively Exploited Cisco Email Gateway Flaw Enables Unauthenticated Root Command Execution
Summary
Cisco says attackers are exploiting CVE-2026-76461 in Secure Email Gateway. The flaw allows unauthenticated root command execution; updates are available, and CISA added it to KEV.
Key points
- CVE-2026-76461 affects Cisco Secure Email Gateway appliances running AsyncOS, both physical and virtual, regardless of configuration.
- An attacker can send a crafted email containing malicious SQL statements to achieve unauthenticated command execution with root privileges.
- Cisco attributes the flaw to insufficient validation in email parsing and says Secure Email and Web Manager and Secure Web Appliance are not affected.
- Cisco fixed the flaw in AsyncOS releases 15.5.5-0141, 16.0.4-302, and 16.5.0-780; no workaround is available besides updating.
- Cisco reported active exploitation and said it contacted customers whose Secure Email Cloud devices showed malicious activity, but did not disclose the attack scale.
- Administrators are advised to review mail logs for suspicious SQL statements and check external network and firewall logs; root access may let attackers hide or remove evidence.
- CISA added the flaw to its KEV catalog and set a September 17, 2026 patch deadline for FCEB agencies.
Article Details
- Vulnerability Types
- Insufficient validation in email parsing logic allowing malicious SQL statements
- Severity
- Critical (CVSS 9.8)
- Affected Versions
- Cisco AsyncOS 15.5 and earlier
- Cisco AsyncOS 16.0
- Cisco AsyncOS 16.5
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 158[.]94[.]211[.]14 | IP address from which a successful Fortinet VPN authentication originated; malicious activity followed in the affected environment. |
MITRE ATT&CK
CVE
People
Vendors
CiscoCisco has warned that CVE-2026-76461 is being actively exploited in Cisco Secure Email Gateway, allowing unauthenticated attackers to run commands as root by sending a crafted email.FortinetThe disclosure also follows reports of large-scale credential attacks against Fortinet VPN appliances, prompting CISA to add the Cisco flaw to its KEV catalog and require urgent patching.
Products
Cisco AsyncOSCVE-2026-76461 affects Cisco AsyncOS for Cisco Secure Email Gateway and is under active exploitation.Cisco Secure Email GatewayCisco has warned that CVE-2026-76461 is being actively exploited in Cisco Secure Email Gateway, allowing unauthenticated attackers to run commands as root by sending a crafted email.Fortinet VPNThe disclosure also follows reports of large-scale credential attacks against Fortinet VPN appliances, prompting CISA to add the Cisco flaw to its KEV catalog and require urgent patching.