Loading vulnerability…
Unauthenticated SQL Injection to Root Command Execution in Cisco Secure Email Gateway
CVE-2026-76461 is an SQL injection vulnerability in the email-parsing functionality of Cisco AsyncOS Software for Cisco Secure Email Gateway. Insufficient validation of email content allows an unauthenticated remote attacker to send a crafted message containing malicious SQL statements through an affected appliance. Successful exploitation permits arbitrary SQL execution and can lead to arbitrary operating-system command execution with root privileges. Vulnerable physical and virtual appliances are affected regardless of configuration. Cisco confirmed active exploitation in September 2026, and the vulnerability is included in CISA's Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can completely compromise the gateway's underlying operating system, affecting confidentiality, integrity, and availability. Root-level access can enable access to or modification of appliance data, credential theft, manipulation of email-security processing, and service disruption. Attackers can also remove or conceal local evidence of compromise. Exposed cluster authentication keys could enable access to additional cluster members; these are potential consequences rather than established activities of the exploitation campaign.
If you can’t patch tonight, do this now.
No configuration workaround eliminates the vulnerability. Pending patching, restrict network exposure to necessary mail flows and trusted upstream systems where operationally feasible, segment mail and management interfaces, restrict administrative access, and disable unnecessary services. Management-interface restrictions alone do not block exploitation through email processing. Review mail logs on every cluster member for suspicious SQL statements, including COPY TO PROGRAM patterns. Preserve and examine externally retained network and firewall logs for anomalous connections and uploads or downloads. A clean local log review cannot exclude compromise because root-level attackers can conceal evidence.
Patch, then assume compromise.
Upgrade Cisco AsyncOS for Secure Email Gateway to the applicable fixed release: 15.5.5-014 for release 15.5 and earlier, 16.0.4-302 for release 16.0, or 16.5.0-780 for release 16.5. Cisco recommends migration to 16.5.0-780. Cisco Secure Email Cloud instances have received the relevant updates. Patching does not eradicate an existing compromise. For suspected compromise of a virtual appliance, preserve forensic evidence, deploy a new VM running fixed software, rebuild its configuration, and renew credentials and installed cryptographic material. Contact Cisco TAC for suspected compromise of a physical appliance.
1 exploit validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
254 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.