Cisco Secure Email Gateway CVE-2026-76461: Unauth SQL Injection to Root

Cisco’s Secure Email Gateway has a critical SQL injection bug that lets a crafted message run commands as root on the appliance. CISA wants federal agencies patched by Wednesday.

If mail still flows through an on-prem or virtual ESA, triage it today instead of waiting for the next change window.

A crafted email reaches root on AsyncOS

On September 14, 2026, Cisco disclosed an unauthenticated SQL injection in how AsyncOS parses email. An attacker who can deliver a malicious message can escalate that SQL into root command execution on the underlying OS. Cisco says there are no workarounds.

CISA added the bug to the Known Exploited Vulnerabilities catalog the same day, with a federal due date of September 17, 2026 and forensic triage required under BOD 26-04. Cisco also shipped a broader September hardening release for AsyncOS; this injection is one of the issues in that set.

The gateway sees every inbound message

Email gateways see every inbound message and often hold quarantine, policy, and credentials. Root on that box gives an attacker full control of a chokepoint that all inbound mail passes through.

Cisco became aware of active exploitation in September 2026. Root also means attackers can wipe local logs, so external firewall and proxy records matter as much as mail_logs.

Upgrade to 16.5.0-780 and check mail_logs on every cluster member

• Inventory every on-prem and virtual Secure Email Gateway. Upgrade to a fixed build (prefer 16.5.0-780).
• If you use Cisco Secure Email Cloud, confirm Cisco’s upgrade to 16.5.0-780 already landed.
• Hunt mail_logs for suspicious SQL (Cisco cites patterns like COPY … TO PROGRAM). Check each cluster member.
• Cross-check external firewall/proxy logs for odd uploads from the appliance or downloads to unfamiliar IPs.
• If compromise looks likely on a virtual appliance: preserve forensics before rebuild, deploy a clean fixed image, restore config, and rotate credentials and crypto material. Physical boxes: open a Cisco TAC case with remote access enabled.
• If you’re still on an affected train, apply the whole September hardening guidance instead of fixing only this CVE.

Details

• CVE: CVE-2026-76461 (CVSS 9.8)
• Product: Cisco AsyncOS for Secure Email Gateway (physical and virtual)
• Not affected: Secure Email and Web Manager; Secure Web Appliance
• KEV: Added 2026-09-14; federal due 2026-09-17; forensic triage under BOD 26-04
• Workarounds: None

Advisory: cisco-sa-esa-inj-2bLVGmhX. Hardening release: cisco-sa-hardening-esa-dfCrfXkm.

Hunt / verify

• Search mail_logs for SQL-looking payloads and COPY … TO PROGRAM-style abuse.
• Compare appliance outbound connections against baseline; assume local IoCs may be incomplete once an attacker has had root.
• Confirm the installed AsyncOS version matches a fixed build above. “Updates applied” is not enough.

Sources

• Cisco PSIRT: Secure Email Gateway SQL Injection (CVE-2026-76461)
• Cisco: Secure Email Gateway / Email and Web Manager Security Hardening — September 2026
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-76461 (due 2026-09-17)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].