Cisco Warns of Actively Exploited Critical SQL Injection Flaw in Secure Email Gateway

Cisco has disclosed a critical SQL injection vulnerability in its Cisco Secure Email Gateway that could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Tracked as CVE-2026-76461, the vulnerability carries a CVSS 3.1 base score of 9.8 and is classified under CWE-89, which covers improper neutralisation of special elements used in an SQL command.

The vulnerability affects Cisco Secure Email Gateway appliances running vulnerable versions of Cisco AsyncOS Software. Cisco says both physical and virtual appliances are affected, regardless of device configuration.

More importantly for organisations operating the affected product, Cisco's Product Security Incident Response Team said it became aware of active exploitation in September 2026.

What is CVE-2026-76461?

The vulnerability exists in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway.

According to Cisco, insufficient validation in the email parsing process allows an attacker to send a specially crafted email containing malicious SQL statements through an affected device.

If exploitation succeeds, the attacker could execute arbitrary SQL statements. Cisco says this can ultimately lead to command execution with root privileges on the underlying operating system.

The vulnerability does not require authentication, and Cisco's CVSS vector identifies network-based exploitation with low attack complexity and no user interaction requirement.

That combination makes the vulnerability particularly significant for organisations relying on Secure Email Gateway as part of their email security infrastructure.

How the attack path works

At a high level, the attack begins with a specially crafted email message being processed by a vulnerable Secure Email Gateway.

The vulnerable email parsing logic does not sufficiently validate the input. Malicious SQL statements can therefore reach the affected processing path.

If the attack is successfully executed, the attacker may gain the ability to execute SQL statements and ultimately run commands with root privileges on the underlying operating system.

This means the issue extends beyond the confidentiality of individual email messages. Successful exploitation could provide a threat actor with a high level of control over the affected appliance.

Cisco did not disclose additional technical details about the exact SQL statements or complete exploitation chain in the advisory.

Cisco says the flaw is being actively exploited

The advisory makes the situation more urgent by confirming that Cisco PSIRT became aware of active exploitation in September 2026.

Cisco also says the vulnerability was discovered during the resolution of a Cisco Technical Assistance Center support case.

The company has not publicly attributed the activity to a particular threat actor in this advisory.

Additional details were not disclosed in the announcement.

Which products are affected?

Cisco states that the vulnerability affects Cisco Secure Email Gateway, including both:

• Physical appliances

• Virtual appliances

The advisory says the vulnerability affects the product regardless of device configuration.

Cisco has also confirmed that the following products are not affected:

• Cisco Secure Email and Web Manager

• Cisco Secure Web Appliance

Organisations should therefore identify whether they operate Cisco Secure Email Gateway rather than assuming that all Cisco email or web security products are impacted.

Affected versions and fixed releases

Cisco has released software updates addressing the vulnerability.

The advisory identifies the following first fixed releases:

Cisco strongly recommends that customers migrate to AsyncOS 16.5.0-780.

Cisco Secure Email Cloud customers are in a different position. Cisco states that it has already upgraded all Cisco Secure Email Cloud devices to Release 16.5.0-780.

No workaround is available

Cisco explicitly states that there are no workarounds that address this vulnerability.

As a result, organisations running affected versions should prioritise moving to a fixed software release rather than relying solely on configuration changes as a permanent solution.

Cisco describes any available mitigations as temporary measures until an upgrade to fixed software is available.

How administrators can look for signs of exploitation

Cisco provides an indicator of compromise for administrators investigating possible exploitation.

Security teams should review the appliance's mail_logs for suspicious SQL statements. Cisco provides the following example for identifying a potentially malicious SQL statement:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

Cisco notes that the presence of an entry matching this pattern may indicate malicious activity.

For clustered deployments, Cisco recommends reviewing the logs of each cluster device.

However, organisations should not treat the absence of this specific indicator as proof that exploitation did not occur.

Cisco warns that successful exploitation can provide attackers with root-level command execution. With that level of access, threat actors may be able to remove or hide evidence of exploitation.

For this reason, Cisco recommends checking external network and firewall logs for suspicious activity, including unexpected uploads from the affected appliance to external IP addresses or downloads from malicious IP addresses.

What organisations should do now

The appropriate response depends on whether exploitation is suspected and whether the appliance is physical, virtual or part of Cisco Secure Email Cloud.

Physical appliances

If exploitation is suspected on a physical appliance, Cisco recommends contacting Cisco Technical Assistance Center (TAC) for further support.

Cisco also recommends enabling remote access to the affected appliance to help accelerate its investigation.

Virtual appliances

Cisco provides a more extensive recovery process for potentially compromised virtual appliances.

Organisations should first preserve forensic information before taking remediation steps. Cisco warns that deploying a new instance can destroy existing configurations and logs.

Where possible, Cisco recommends:

1. Preserve forensic information.

2. Deploy a new virtual machine running a fixed software release.

3. Rebuild the product configuration.

4. Renew credentials and cryptographic materials installed on the appliance.

5. Continue monitoring for anomalous behaviour.

If restoring the appliance is not possible, Cisco recommends contacting TAC.

If exploitation is not suspected but the appliance is running an affected release, Cisco recommends upgrading to a fixed release.

Cisco Secure Email Cloud

Cisco says it conducted a threat intelligence investigation of Cisco Secure Email Cloud devices.

The company directly contacted customers where indicators of possible compromise were identified and says it is engaged in remediation and recovery operations.

Cisco has also deployed mitigations within its management of the service.

Customers who were contacted should restore affected devices to a secure configuration where possible, including renewing credentials and cryptographic materials.

Hardening recommendations

Cisco also provides several broader security recommendations for Secure Email Gateway deployments.

These include:

• Upgrade to the latest Cisco AsyncOS Software.

• Prevent unnecessary internet access to the appliance.

• Restrict access to known and trusted hosts.

• Separate mail and management functionality across individual network interfaces.

• Place the appliances behind appropriate filtering infrastructure such as firewalls.

• Monitor traffic to and from the appliances.

• Send logs to an external server where possible.

• Disable HTTP for the main administrator portal.

• Disable unnecessary network services, including HTTP and FTP.

• Use stronger authentication mechanisms such as SAML or LDAP where appropriate.

• Replace default administrator passwords with stronger credentials.

• Restrict administrator access according to operational requirements.

• Create operator accounts for administrators.

• Use SSL/TLS with an appropriate certificate.

These recommendations are particularly relevant when an appliance has exposure to untrusted networks.

Why this vulnerability matters

The technical issue is a SQL injection flaw, but the operational risk comes from the potential chain of consequences.

An attacker does not need authentication to send the malicious input described by Cisco. If the exploit succeeds, the attacker may progress from malicious input delivered through email to SQL execution and ultimately command execution with root privileges.

For organisations, this makes patching and incident investigation important at the same time.

A system that has already been compromised requires a different response from a vulnerable system that has not shown signs of exploitation. Cisco's guidance reflects this distinction by recommending forensic preservation and rebuilding procedures where compromise is suspected.

The active exploitation disclosure also means security teams should treat the advisory as an incident-response consideration rather than only a routine software update.

What security teams should prioritise

Organisations using Cisco Secure Email Gateway should first determine whether an affected appliance exists within their environment.

They should then establish the software version and compare it with Cisco's fixed releases.

Where an affected release is running and exploitation is not suspected, Cisco recommends upgrading to a fixed release.

Where exploitation is suspected, teams should preserve forensic evidence before rebuilding or replacing a virtual appliance and should investigate external network and firewall telemetry alongside local appliance logs.

For clustered environments, Cisco recommends checking the logs of each cluster device.

The company also recommends renewing credentials and cryptographic materials where compromise has occurred and continuing to monitor the environment for anomalous behaviour.

Broader security context

The disclosure highlights a broader industry shift toward treating security appliances as high-value infrastructure that requires the same vulnerability management and incident-response discipline as other enterprise systems.

Email security gateways sit directly in the path of email traffic, making vulnerabilities in their processing components potentially significant for organisations that depend on them.

In this case, Cisco's advisory combines three important elements: a critical severity rating, a path to root-level command execution, and confirmed active exploitation.

For enterprises, this could mean that vulnerability management teams need to coordinate closely with email infrastructure administrators, SOC teams and incident responders when assessing exposure.

The advisory also demonstrates why external logging is important. If an attacker gains elevated privileges on a security appliance, local evidence may no longer be fully trustworthy. Cisco's recommendation to cross-check firewall and network telemetry provides an additional source of evidence during an investigation.

The bottom line

CVE-2026-76461 is a critical SQL injection vulnerability affecting Cisco Secure Email Gateway that Cisco says is being actively exploited.

Cisco has released fixed software and states that there are no workarounds addressing the vulnerability.

Organisations running affected Cisco AsyncOS releases should assess their exposure and upgrade to an appropriate fixed release. If exploitation is suspected, Cisco's guidance calls for forensic preservation, investigation and recovery measures rather than simply applying an update.

The immediate priority is therefore twofold: patch vulnerable appliances and determine whether exploitation has already occurred.