Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root

Cisco has released security updates to address a critical SQL injection vulnerability in the Cisco Secure Email Gateway. This vulnerability can be exploited remotely and without authentication, allowing attackers to execute arbitrary commands with root privileges on affected devices.

Tracked as CVE-2026-76461, this flaw has a CVSS base score of 9.8 out of 10. It affects Cisco AsyncOS Software running on both physical and virtual Cisco Secure Email Gateway devices.

Cisco disclosed the issue on September 14, warning that all vulnerable gateway deployments are at risk, regardless of their configuration.

Cisco Secure Email Gateway Flaw

The vulnerability, identified by Cisco bug ID CSCwu56234, arises from insufficient validation in the product’s email parsing logic. An attacker can send a specially crafted email containing malicious SQL statements to an exposed Cisco Secure Email Gateway appliance.

If successfully exploited, this SQL injection could allow the attacker to execute arbitrary SQL commands and gain root-level access to the underlying operating system.

According to Cisco’s security advisory, “An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device.”

Root-level command execution poses a severe risk to organizations, as it could provide attackers with complete control over the compromised email security appliance.

A compromised gateway may allow threat actors to alter configurations, access stored data, establish persistence, turn off security controls, or use the device as a staging point for attacks against internal infrastructure.

Cisco confirmed that the vulnerability affects Cisco Secure Email Gateway appliances, including both physical and virtual instances. However, Cisco Secure Email and Web Manager as well as Secure Web Appliance products are not vulnerable to CVE-2026-76461.

Cisco has not provided a workaround for this SQL injection vulnerability and strongly recommends that administrators upgrade to a fixed AsyncOS release as soon as possible. The following Cisco AsyncOS releases contain fixes:

Cisco AsyncOS release: First fixed release

• 15.5 and earlier: 15.5.5-0141
• 16.0: 16.0.4-3021
• 16.5: 16.5.0-780

Cisco advises customers to migrate to AsyncOS Release 16.5.0-780 where possible. Administrators can apply the updates through the appliance’s web-based management interface by navigating to System Administration > System Upgrade, selecting Upgrade Options, and choosing Download and Install.

Cisco recommends that administrators review mail logs for suspicious SQL statements that could indicate exploitation attempts. Organizations can search IronPort text mail logs for SQL commands involving “COPY … TO PROGRAM” using the following command:

grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

Any matching entries may suggest potentially malicious activity, though Cisco notes that this detection pattern is not exhaustive. Organizations operating clustered Secure Email Gateway deployments should inspect logs on all cluster devices.

Cisco has also warned that threat actors with root access may delete, modify, or conceal evidence on the compromised appliance.

Administrators should review external telemetry, including firewall and network logs, for suspicious outbound connections, unexpected uploads to external IP addresses, or downloads the gateway initiates from malicious sources.

Cisco Secure Email Cloud customers without command-line access may find it challenging to perform these checks independently. Cisco has contacted cloud customers directly when it detected malicious activity.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.