CVE-2026-76461: Cisco Secure Email Gateway mail-parsing SQL injection exploited in the wild, root command execution

Cisco on 14 Sep disclosed CVE-2026-76461, a CVSS 9.8 SQL injection in Secure Email Gateway mail parsing. An unauthenticated remote attacker who sends one crafted email obtains root. CISA added it to KEV the same day; patch by 17 Sep. No official workaround.

Cisco on 14 Sep 2026 disclosed CVE-2026-76461, a critical SQL injection in Cisco Secure Email Gateway mail parsing. CVSS 3.1 score 9.8. An unauthenticated remote attacker who delivers one crafted email to the gateway can execute arbitrary commands as root on the underlying OS. CISA added it to the Known Exploited Vulnerabilities catalog (KEV) the same day. Federal agencies must patch by 17 Sep. Cisco states there is no temporary workaround.

Incident overview

The flaw is in Cisco AsyncOS inbound mail parsing. SQL injection (CWE-89). Parser code does not adequately validate mail content. An attacker who crafts a message containing malicious SQL can poison backend database queries, then pivot from database control to OS command execution. Cisco confirms physical and virtual appliances are affected, independent of device configuration. Fixed versions:

• 15.5 and earlier branches: 15.5.5-014
• 16.0.x branch: 16.0.4-302
• 16.5.x branch: 16.5.0-780 (vendor-recommended target)

Affected builds include 13.0.0-392, 13.5.1-277, 14.0.0-698, 14.2.0-620, 14.3.0-032, 15.0.x, 15.5.x, and 16.0.0-050 through 16.0.4-016, 23 entries total. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected. Secure Email Cloud appliances have already been upgraded by the vendor to 16.5.0-780.

Technical details and attack vector

Exploit preconditions are minimal: no account, no user interaction, no special device config. The message only needs to pass through normal gateway receive. Cisco has not published the specific parse fields or code location.

`Send crafted email → mail-parsing logic extracts values → SQL statement concatenation and execution
→ arbitrary SQL execution at the database layer → OS command execution → root privileges`

Mail gateways typically sit just inside the enterprise network boundary and are trusted by default by internal systems. Compromise yields a persistent foothold inside the trust boundary, with access to mail in transit and a path to lateral movement.

Impact

CVSS vector: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — network-exploitable, low complexity, no privileges, no user interaction; confidentiality, integrity, and availability all high. Same-day KEV listing means confirmed in-the-wild exploitation. Cisco has proactively contacted cloud customers whose devices showed signs of malicious activity. Mail gateways are mandatory boundary devices for most mid-to-large orgs: wide exposure, low bar, root-level outcome. Treat as an emergency change.

Remediation

• Upgrade immediately to 15.5.5-014, 16.0.4-302, or 16.5.0-780. Prefer the last.
• Web UI: System Administration > System Upgrade, click Upgrade Options, select Download and Install. CLI: run `upgrade`, then enter `DOWNLOADINSTALL`.
• If compromise is suspected, upgrade alone is not enough. Contact vendor support — a root-level attacker can wipe traces. Cross-check network and firewall logs.
• Detection: search IronPort text mail logs (default mail_logs) for suspicious SQL. On clustered deployments, run on every member. Also hunt unexpected outbound uploads from the gateway to external addresses.

`cisco-esa> grep -i \"COPY.*TO PROGRAM\" [IronPort Text Mail Logs / default mail_logs]`

Sources

• Cisco Security Advisory: Cisco Secure Email Gateway SQL Injection Vulnerability
• CVE-2026-76461 official record
• Beazley Security Labs BSL-A1207