Cisco Secure Email Gateway CVE-2026-76461 Actively Exploited — Patch Now

Cisco has disclosed that a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway is being actively exploited in the wild, enabling unauthenticated remote attackers to execute arbitrary commands with root privileges. Tracked as CVE-2026-76461, the flaw carries a CVSS score of 9.8 out of 10 and stems from insufficient validation in the device's email parsing logic. According to Cisco's advisory, attackers can exploit the bug by sending a crafted email message containing malicious SQL statements through an affected appliance. The vulnerability affects both physical and virtual Cisco Secure Email Gateway deployments regardless of device configuration, though Secure Email and Web Manager and Secure Web Appliance are not impacted.

Patches are available across three supported branches of AsyncOS: Release 15.5 and earlier (fixed in 15.5.5-0141), 16.0 (fixed in 16.0.4-302), and 16.5 (fixed in 16.5.0-780). Cisco has confirmed no workarounds exist beyond updating to a patched build. The company became aware of active exploitation earlier this month and has directly notified customers whose Cisco Secure Email Cloud devices showed signs of malicious activity, though it declined to disclose the scale of the attacks. Administrators are urged to review mail_logs for suspicious SQL statements — specifically running `cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]` — and to investigate each node in clustered deployments, as the presence of any matching entry may indicate compromise. Because threat actors operating with root privileges can erase or conceal forensic evidence, admins should also cross-check external network and firewall logs for anomalous outbound uploads or downloads to and from unfamiliar IP addresses. A WHOIS lookup on any suspicious external endpoints can help administrators attribute traffic to known hosting providers or bulletproof infrastructure.

CISA has added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies apply patches by September 17, 2026. Given the severity of the flaw and confirmed in-the-wild abuse, all organizations running Cisco Secure Email Gateway should treat remediation as urgent. Security teams should also conduct a broader exposure assessment of internet-facing appliances — a quick port scanner check can confirm whether management or SMTP services on affected hosts are publicly reachable and whether restricting access to trusted IPs is in place. To better defend against perimeter threats that may route malicious traffic through anonymizing networks, running a VPN/proxy detector against inbound connections can help surface traffic originating from anonymized sources, a useful triage signal during active exploitation campaigns like this one.