Act nowKnown exploited

Advisory · CVE-2026-76461

A crafted email can hand root to attackers on Cisco Secure Email Gateway

A SQL injection flaw in the email parsing of Cisco AsyncOS for Secure Email Gateway lets an unauthenticated attacker execute arbitrary commands with root privileges by sending a malicious email.

Advisory published September 14, 2026Independent summary
Vendor
Cisco
Product
Secure Email Gateway
Identifier / CWE
CVE-2026-76461
CWE-89
Action timing
Oct 5, 2026
ELI5

Explain it like I’m five

The email scanner reads every letter for dangerous words but does not check the grammar of its own notes. A letter written in a special way makes the scanner run the attacker's errands as the boss of the whole machine.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Malicious email arrives

    An unauthenticated attacker sends a crafted email containing malicious SQL statements through the gateway.

  2. 02Parsing flaw

    Insufficient validation in the email parsing logic lets the SQL statements reach the database.

  3. 03Arbitrary SQL

    The attacker executes arbitrary SQL statements against the appliance.

  4. 04Root commands

    The SQL execution escalates to arbitrary operating-system commands running with root privileges.

What happened

On September 14, 2026, Cisco disclosed a SQL injection vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway (SEG). CISA added it to the Known Exploited Vulnerabilities catalog the same day. The flaw is rated critical at CVSS 9.8.

An unauthenticated, remote attacker sends a crafted email message containing malicious SQL statements through an affected device. Insufficient validation in the email parsing logic allows those statements to execute as arbitrary SQL, and a successful exploit leads to arbitrary command execution with root privileges on the underlying operating system.

Two details make this worse than a single-host compromise. Cisco notes that SEG appliances in a cluster use private SSH key pairs for communication between cluster members, and those keys are reachable on a compromised appliance, so one exploited gateway can open the rest of the cluster. For Cisco Secure Email Cloud, Cisco states it has already investigated, contacted affected customers directly, and deployed mitigations within its management.

What to do

  1. Upgrade every affected appliance to the fixed Cisco AsyncOS release named in the Cisco advisory.
  2. Assume any internet-exposed appliance running an affected release may be compromised and hunt accordingly.
  3. If exploitation is suspected on a physical appliance, contact Cisco TAC with remote access enabled so their investigation can proceed quickly.
  4. If exploitation is suspected on a virtual appliance, record forensics first, then deploy a fresh VM at the fixed release, rebuild the configuration, and renew all credentials and cryptographic material on the appliance.
  5. In a cluster where at least one member may be compromised, restore every member to a secure configuration; do not trust the cluster’s shared SSH keys afterward.
  6. Harden all appliances: remove internet exposure where possible, separate mail and management interfaces, filter management traffic behind firewalls, send logs to an external server, disable HTTP for the admin portal and any unused services, and change the default administrator password.
  7. Monitor appliance logs for unexpected inbound or outbound traffic as an ongoing control.

Management note

This is unauthenticated root command execution on the internet-facing mail gateway, the box that sees every inbound email. The exploit needs no credentials and only a crafted message, and cluster trust relationships can carry one compromise across the whole fleet. Treat patching as urgent and pair it with a compromise review, especially for clustered deployments.