Cisco Patches Actively Exploited Secure Email Gateway Flaw
The critical vulnerability could give an unauthenticated remote attacker root-level access to affected systems.
- By Danielle Naidu
- Sep 15, 2026
An actively exploited flaw in Cisco Secure Email Gateway has prompted Cisco to release software fixes for affected physical and virtual appliances.
Tracked as CVE-2026-76461, the flaw carries a Common Vulnerability Scoring System score of 9.8 out of 10. Insufficient validation within the product’s email-parsing logic allows an attacker to deliver malicious SQL statements through a crafted email. Successful exploitation could enable arbitrary command execution with root privileges.
The vulnerability affects Cisco Secure Email Gateway regardless of device configuration. No workaround is available. Fixed versions include AsyncOS releases 15.5.5-014, 16.0.4-302 and 16.5.0-780, with Cisco recommending migration to the last of those releases. Cisco has already upgraded Secure Email Cloud devices and contacted customers whose systems showed signs of possible compromise.
Administrators should examine mail logs for suspicious SQL statements and review external network and firewall logs for unexpected transfers. Attackers with root access may be able to conceal evidence on an affected appliance. Cisco recommends preserving forensic information before rebuilding a compromised virtual appliance, then renewing its credentials and cryptographic materials.
About the Author
Danielle Naidu is assistant editor for Security Today, Campus Security Today, Occupational Health & Safety and Environmental Protection Online.