Affected Systems

Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS Software versions 15.5 and earlier, 16.0, and 16.5. All device configurations are vulnerable. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.

Exploitation Status

Actively exploited in the wild. Cisco detected malicious activity in September 2026 and directly notified affected Cisco Secure Email Cloud customers. CISA added CVE-2026-76461 to the KEV catalog on September 15, 2026.

Business Impact

Unauthenticated remote attackers can execute arbitrary commands with root privileges by sending a crafted email containing malicious SQL statements. Successful exploitation grants full system control, enabling attackers to remove forensic evidence, exfiltrate data, pivot to internal networks, or deploy additional malware. Email gateway compromise can expose all inbound/outbound email traffic and credentials.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade Cisco AsyncOS for Secure Email Gateway to fixed versions: 15.5.5-0141 (for 15.5 and earlier), 16.0.4-302 (for 16.0), or 16.5.0-780 (for 16.5).
  • Run detection command on all devices and cluster members: cisco-esa> grep -i "COPY.*TO PROGRAM" mail_logs to identify suspicious SQL injection attempts.
  • Review mail_logs on all devices for anomalous SQL statements. If clustered, check logs on every cluster member individually.
  • Examine external network, firewall, and proxy logs for unexpected outbound connections or data exfiltration from Cisco Secure Email Gateway appliances to external IP addresses.
  • Assume compromise if indicators are found: conduct full incident response including credential rotation, threat hunting for lateral movement, and forensic analysis of network traffic logs outside the appliance.