Cisco Secure Email Gateway CVE-2026-76461 is under active attack

Cisco says attackers are actively exploiting CVE-2026-76461, a pre-authentication SQL-injection flaw in AsyncOS for Cisco Secure Email Gateway. A successful exploit can reach arbitrary command execution with root privileges on the underlying appliance. Cisco has released fixed software and says there is no workaround.

The affected Cisco appliances

The vulnerability affects physical and virtual Cisco Secure Email Gateway deployments, regardless of device configuration. Cisco rates it 9.8/10 under CVSS 3.1 and attributes the flaw to insufficient validation in email-parsing logic. An attacker can send a crafted message containing malicious SQL statements through an affected device.

The Canadian Centre for Cyber Security independently confirms the September 14 disclosure, active exploitation, and CISA’s addition of CVE-2026-76461 to the Known Exploited Vulnerabilities catalog. That makes this an incident-response and patching priority for exposed appliances, not a routine maintenance item.

Fixed releases and immediate checks

Cisco lists AsyncOS 16.5.0-780 as the fixed release for Cisco Secure Email Gateway. Cisco Secure Email Cloud devices have already been upgraded to that release according to the advisory. Administrators running physical or virtual appliances should verify the exact installed version and upgrade through Cisco’s documented process.

There is no compensating workaround. If an upgrade must be coordinated, restrict unnecessary internet exposure and separate mail-handling and management paths where possible, but treat those measures as temporary risk reduction rather than a fix.

Look for signs of exploitation

Cisco recommends reviewing mail_logs on every cluster device for suspicious SQL statements. The advisory gives COPY.*TO PROGRAM as one non-exhaustive search pattern. Because successful exploitation can provide root access and allow attackers to remove or hide local evidence, cross-check firewall and network telemetry for unexpected downloads, uploads, and outbound connections from the appliance.

If compromise is suspected, preserve forensic information before rebuilding a virtual appliance. Cisco recommends deploying a new fixed instance where appropriate, renewing credentials and cryptographic material installed on the appliance, and contacting Cisco TAC for further support. A replacement deployment can destroy configurations and logs, so capture evidence first.

Evidence and scope

Cisco’s advisory identifies CVE-2026-76461, the 9.8 CVSS score, affected Secure Email Gateway products, fixed release 16.5.0-780, active exploitation, and the absence of a workaround. The Canadian Centre for Cyber Security’s alert provides independent confirmation of the exploitation status and CISA KEV listing. Neither source establishes that every deployment has been compromised; administrators still need to investigate their own telemetry.

The concrete next step is version verification followed by the fixed-release upgrade. Organizations that find suspicious activity should preserve evidence and treat the appliance as potentially compromised until their incident-response process clears it.