Cisco Secure Email Gateway Flaw Exploited for Root Access

A critical vulnerability in Cisco Secure Email Gateway software is under active exploitation, allowing unauthenticated remote attackers to gain root-level control over affected devices.

The flaw, identified as CVE-2026-76461, carries a CVSS score of 9.8 out of 10.0. It originates from insufficient validation within the email parsing logic of Cisco AsyncOS Software.

Attackers can exploit the weakness by sending crafted email messages containing malicious SQL statements. A successful attack allows the execution of arbitrary commands with root privileges on the underlying operating system.

Affected Systems and Scope

The vulnerability impacts both physical and virtual versions of the Cisco Secure Email Gateway, regardless of the device configuration. Cisco has clarified that other products, including Secure Web Appliance and Secure Email and Web Manager, are not affected by this specific flaw.

Cisco has confirmed it is directly contacting customers who own Cisco Secure Email Cloud devices where malicious activity has been detected. The company has not disclosed the total scale of these attacks.

CISA Response and Mandatory Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue. This action requires Federal Civilian Executive Branch (FCEB) agencies to apply necessary patches by 17 September 2026.

Remediation and Detection

There are no known workarounds to mitigate this risk other than upgrading to the latest supported software versions. Fixed versions include:

• AsyncOS 15.5 (fixed in 15.5.5-0141)
• AsyncOS 16.0 (fixed in 16.0.4-302)
• AsyncOS 16.5 (fixed in 16.5.0-780)

To identify potential compromises, administrators should review mail_logs for suspicious SQL statements. Running the following command can help detect malicious entries: grep -i "COPY.*TO PROGRAM" mail_logs.

Because attackers with root access may attempt to hide evidence of their presence, Cisco recommends that administrators cross-check network and firewall logs. Security teams should look for anomalous activity, such as unexpected data uploads from the affected device to external IP addresses or downloads from malicious sources.