Cisco has issued emergency patches for a critical vulnerability in its Secure Email Gateway that could allow attackers to gain complete control over the device just by sending malicious emails. This vulnerability, tracked as CVE-2026-76461, is characterized as an SQL injection due to inadequate validation in the email parsing code of the appliance. The main function of this device is to parse incoming emails for potential threats, making this attack vector particularly straightforward.
Cisco warns that an attacker can exploit this vulnerability by sending a specially crafted email containing malicious SQL statements. If successful, this would enable the attacker to execute arbitrary SQL commands and obtain root privileges on the operating system. The flaw impacts both physical and virtual versions of the Secure Email Gateway.
Patch releases for this vulnerability include AsyncOS firmware versions 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Cisco’s product security team became aware of active exploitation earlier in the month, leading to the US Cybersecurity and Infrastructure Security Agency (CISA) adding this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Given that this is a zero-day exploit, simply updating to the patched firmware is insufficient; organizations must also check if their appliances were compromised. Reviewing mail_logs for suspicious SQL statements is one suggested method, although attackers with root access can manipulate logs to obscure their actions. Cisco recommends examining any network logs for unusual activities, like irregular file transfers with external IP addresses.
For suspected exploitation on physical devices, businesses should consult the Cisco Technical Assistance Center. For virtual devices, it is advisable to collect forensic data and deploy a new instance with a rebuilt configuration and new credentials.
Cisco has already reviewed devices enrolled in Cisco Secure Email Cloud, reaching out to those potentially affected. The advisory also includes general recommendations for enhancing device security. According to Josh Picolet, the vice president of detection and analysis at Team Cymru, "A root-level, unauthenticated RCE in an email gateway is about as good a foothold as an attacker gets." This incident highlights the importance of treating edge appliances as durable access points rather than one-off targets.
For additional details, refer to the Cisco advisory and the CISA KEV catalog.
