Cisco Secure Email Gateway SQL Injection Vulnerability

In plain language

What this advisory means

A critical security flaw was discovered in Cisco Secure Email Gateway devices. This flaw lets attackers send specially crafted emails with malicious code that can run commands on the device with full administrative rights. This means attackers can take control of the underlying system without needing to log in. Cisco has released updated software versions to fix this issue. There are no temporary workarounds available, so users should update their devices promptly to stay protected.

Technical explanation

How the issue affects the environment

The vulnerability arises from insufficient validation in the email parsing logic of Cisco AsyncOS software running on Secure Email Gateway devices. An unauthenticated, remote attacker can exploit this by submitting crafted email messages containing malicious SQL statements. Exploiting this leads to arbitrary SQL command execution, which in turn allows the attacker to execute system commands with root privileges on the underlying operating system. Affected devices include physical and virtual Cisco Secure Email Gateway appliances running AsyncOS versions prior to the fixed releases. Cisco has identified the flaw as CVE-2026-76461 and rates it with a CVSS 3.1 base score of 9.8, indicating critical severity. Due to the high privilege level gained, attackers can potentially remove evidence and compromise cluster communications by obtaining SSH keys.

Operational impact

Why teams should care

An attacker who successfully exploits this vulnerability could gain full root control over Cisco Secure Email Gateway appliances. This compromises the confidentiality, integrity, and availability of the device, potentially allowing interception or modification of email traffic, disruption of email services, and use of the gateway as a foothold for further network attacks. Because of root access, attackers can remove traces of their activity, complicating incident detection and response. Organizations relying on these gateways for email protection face a significant risk until devices are upgraded.

Affected and fixed releases

Temporary risk reduction

Cisco has stated that no workarounds or temporary mitigations are available for this vulnerability. The only effective remediation is to upgrade to a fixed software release.

Evidence and validation checklist

• Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX documents the vulnerability and remediation details.
• Cisco PSIRT reports active exploitation observed in the wild (September 2026).
• Cisco AsyncOS software release notes specify fixed versions: 15.5.5-014, 16.0.4-302, 16.5.0-780.
• Log inspection instructions are provided to detect attempted exploitation via SQL statements in mail logs.
• No workarounds are available per Cisco advisory.
• Cisco confirmed vulnerability affects both physical and virtual Cisco Secure Email Gateway appliances.