Cisco Email Gateway Zero-Day CVE-2026-76461: A Crafted Email Gets Root; CISA Gives 3 Days
🛡️ Security •

Cisco Email Gateway Zero-Day CVE-2026-76461: A Crafted Email Gets Root; CISA Gives 3 Days

A SQL injection bug in Cisco Secure Email Gateway's mail parser gives unauthenticated attackers root from a single message. Cisco confirms exploitation; CISA set a 17 September deadline.

AB
Anthony Bahn IT Director & Cybersecurity Consultant
ciscoemail securitysql injectioncisa kevzero-day

Cisco published an advisory on 14 September 2026 for CVE-2026-76461, a SQL injectionSQL Injection🛡️A vulnerability where untrusted input is concatenated into a database query so an attacker can alter what the query does. Consequences range from reading or modifying data to executing operating-system commands when the database engine runs with high privilege and exposes file or program features. bug in the email parsing logic of AsyncOS on Cisco Secure Email Gateway. An unauthenticated attacker exploits it by sending a crafted email through the appliance. The result is arbitrary command execution as root on the underlying operating system. Cisco's PSIRT says it became aware of active exploitation this month, and CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day with a remediation deadline of 17 September.

What Happened

The advisory (cisco-sa-esa-inj-2bLVGmhX, version 1.0, marked final) rates the flaw at CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and classifies it as CWE-89. The Cisco bug ID is CSCwu56234. According to Cisco, the vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. "is due to insufficient validation in the email parsing logic," and a successful exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. lets the attacker "execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system."

The delivery mechanism is the important part. There is no login page to brute-force and no management port to find. The attacker needs only to get a message to the gateway, which is precisely the job the gateway exists to do. Every inbound message from the internet passes through the parser that contains the bug.

Cisco says it found the flaw while resolving a TAC support case, which is the same way it discovered the previous AsyncOS zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. in December 2025. The advisory does not describe the attackers, the scale of the campaign, or what they did after gaining root. Cisco has stated that all Secure Email Cloud devices were already upgraded to Release 16.5.0-780, and that it has directly contacted cloud customers where indicators of compromise were found.

Who Is Affected

The advisory scopes the bug to Cisco Secure Email Gateway, physical and virtual, "regardless of device configuration." That last phrase matters. The November 2025 campaign against CVE-2025-20393 only worked against appliances with the Spam Quarantine feature exposed to the internet. This one has no such precondition. If the appliance receives mail, it is reachable.

Cisco has confirmed that Secure Email and Web Manager and Secure Web Appliance are not vulnerable to CVE-2026-76461.

Fixed releases per the advisory:

| AsyncOS release | First fixed release | |---|---| | 15.5 and earlier | 15.5.5-0141 | | 16.0 | 16.0.4-3021 | | 16.5 | 16.5.0-780 |

There are no workarounds. Cisco's companion "Security Hardening Release: September 2026" advisory (cisco-sa-hardening-esa-dfCrfXkm), published the same day, bundles fixes for five more CVEs affecting both Secure Email Gateway and Secure Email and Web Manager: CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, and CVE-2026-76443. Four of those are rated 9.8 and cover path traversalPath Traversal🛡️A web vulnerability (CWE-22) where user-supplied input in a file path escapes the directory the application intended to serve from, typically via parent-directory references, letting an attacker read or write files elsewhere on the server., access control, and injection classes. The hardening advisory says only the SQL injection bug is known to be exploited. Note that the hardening advisory does not list a fixed 16.0 build for those five bugs; it tells 16.0 users to migrate to a fixed release, so 16.5.0-780 is the safest landing point for a 16.0 fleet.

BleepingComputer reports that Shadowserver currently tracks more than 400 internet-exposed Cisco Secure Email Gateway appliances, with no data on how many are honeypots or already patched. Since a mail gateway accepts SMTP from anyone by design, exposure counts undercount the real reachable population.

Technical Analysis

SQL injection in an email parser is an unusual combination, and the indicator Cisco published tells you how the bug turns into a shell. The advisory instructs administrators to search the text mail log (default name mail_logs) for the pattern "COPY.*TO PROGRAM" using the appliance's grep command, and states that "the presence of any entry in the output may indicate malicious activity."

COPY ... TO PROGRAM is PostgreSQL syntax. Per the PostgreSQL documentation, "when PROGRAM is specified, the server executes the given command," and that command runs "from the viewpoint of the server," executable by the PostgreSQL OS user. The docs restrict the feature to superusers or roles granted pg_execute_server_program because it "allows reading or writing any file or running a program that the server has privileges to access." Cisco's advisory states the outcome is root, which means whatever process executes the injected statement holds root on the appliance. The pattern is a textbook example of how SQL injection becomes root command execution on an appliance: a query-language bug becomes an OS-level compromise because the database engine is trusted with far more than the database.

The attack traffic is email. That has two consequences for defenders. First, the exploit message likely arrives from an arbitrary external sender, so IP allowlistingIP Allowlisting🌐A network access control that permits connections to a service only from an explicit list of approved source addresses or subnets, denying everything else. Applied at the edge, on the host, or both. on port 25 is not a viable control. Second, the parser runs before any policy decision, so anti-spam verdicts, quarantines, and content filters are irrelevant to whether the bug triggers. The gateway is attackable by anyone who can send it mail, and that is a structural property of the product category, not a Cisco-specific oversight.

Cisco has been here before. CVE-2025-20393, a CVSS 10.0 input validation flaw in AsyncOS, was exploited from late November 2025 by a group Cisco Talos tracks as UAT-9686, assessed with moderate confidence as a China-nexus actor. Cisco became aware on 10 December 2025 and shipped fixes in mid-January 2026, roughly two months after exploitation began. That campaign deployed a Python backdoor (AquaShell), a reverse-SSH implant (AquaTunnel), the Chisel tunneling tool, and a log-clearing utility. Whether the current exploitation is the same actor is not something any fetched source states, but the earlier toolkit is a reasonable model for what post-exploitation on a root-owned email gateway looks like.

Immediate Actions

  1. **Upgrade now.** Move to 15.5.5-0141, 16.0.4-3021, or 16.5.0-780 depending on your train. Cisco's hardening advisory documents both paths: the web UI under System Administration > System Upgrade, or the upgrade command from the CLI. If you run 16.0, prefer 16.5.0-780 so the companion fixes land at the same time.
  2. **Search the mail logs on every cluster member.** Run the advisory's grep against mail_logs on each appliance individually. Clustered configuration does not centralize this log, and a hit on one node tells you nothing about its peers.
  3. **Assume evidence may be gone.** An attacker with root can edit or truncate mail_logs, and the previous AsyncOS campaign shipped a purpose-built log cleaner. Cross-check with what the appliance cannot alter: firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. and proxy logs for outbound connections from the gateway, especially SSH on unexpected ports or long-lived sessions to unfamiliar addresses. If you need a method, see how to check an email security gateway for compromise after a zero-day. The earlier article on detecting reverse-tunnel implants covers the network side in more depth.
  4. **Rotate what the gateway holds.** If any indicator is present, treat LDAP bind credentials, SMTP relay credentials, TLS private keys, and any API tokens configured on the appliance as compromised.
  5. **Track the deadline.** The KEV entry sets a 17 September due date for federal civilian agencies under BOD 26-04BOD 26-04🛡️CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier.. That directive's three-day tier is reserved for flaws that are publicly exposed, in KEV, automatable, and grant total control, and it requires a forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs. of the asset in addition to patching. That is a reasonable standard for everyone, not just agencies.

Long-Term Outlook

Two root-level zero-days in the same product line in ten months should change how you model this appliance. It sits in the data path for every inbound message, it usually holds directory credentials, and its parser is exposed to the entire internet with no authentication in front of it. Restrict its egress to the destinations it genuinely needs, put it in a segment where a root compromise cannot reach mail stores or domain controllers directly, and build a rehearsed playbook for re-imagingRe-imaging🛡️Wiping a device and reinstalling its operating system and firmware from clean vendor media rather than patching in place. Re-imaging is the standard recovery step for a compromised appliance because a patch closes the vulnerability but does not remove anything an attacker installed after exploiting it. it. The 72-hour KEV triage process already on this site applies, but the forensic step now matters as much as the patch.

Sources

  • Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX, "Cisco Secure Email Gateway SQL Injection Vulnerability," 14 September 2026: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
  • Cisco Security Advisory cisco-sa-hardening-esa-dfCrfXkm, "Security Hardening Release: September 2026": https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
  • CISA Known Exploited Vulnerabilities feed, catalog version 2026.09.14: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • CISA alert, "CISA Adds One Known Exploited Vulnerability to Catalog," 14 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog
  • CISA BOD 26-04, "Prioritizing Security Updates Based on Risk": https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
  • NVD, CVE-2026-76461: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76461
  • BleepingComputer, Sergiu Gatlan, 15 September 2026: https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/
  • SecurityWeek, Eduard Kovacs, 15 September 2026: https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/
  • The Hacker News, 15 September 2026: https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html
  • BleepingComputer, "Cisco finally fixes AsyncOS zero-day exploited since November," 16 January 2026: https://www.bleepingcomputer.com/news/security/cisco-finally-fixes-asyncos-zero-day-exploited-since-november/
  • Corelight, "Detecting CVE-2025-20393 on Cisco Email Gateways," 19 December 2025: https://corelight.com/blog/detecting-cve-2025-20393
  • PostgreSQL documentation, COPY: https://www.postgresql.org/docs/current/sql-copy.html
← Back to All News