Cisco Warns of Active Exploitation of CVE-2026-76461 SQL Injection Vulnerability in Secure Email Gateway

Critical SQL Injection Vulnerability in Cisco Secure Email Gateway

On September 14, 2026, Cisco issued a security advisory regarding CVE-2026-76461, a critical SQL injection vulnerability affecting the Cisco AsyncOS Software for Cisco Secure Email Gateway. This vulnerability has a CVSS v3.1 base score of 9.8, indicating its severity, as it could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected appliances.

The Cisco Secure Email Gateway, previously known as IronPort Email Security Appliance, is designed to inspect both inbound and outbound emails for various threats, including phishing and malware. The nature of this vulnerability means that exploitation does not require access to an administrative interface or authentication, as attackers can trigger it by sending specially crafted emails through a vulnerable gateway.

Notably, CVE-2026-76461 was added to the CISA’s Known Exploited Vulnerabilities (KEV) catalog on the same day it was disclosed, suggesting that it was actively exploited as a zero-day vulnerability prior to the advisory. Cisco’s Product Security Incident Response Team (PSIRT) became aware of the active exploitation in September 2026. At this time, there is no public proof-of-concept exploit code available, nor is there any attribution for the threat actor involved.

Mitigation Guidance

Organizations utilizing Cisco Secure Email Gateway are urged to prioritize upgrading to a vendor-supplied fixed version immediately, outside of regular patching cycles. The following versions are affected:

Given the active exploitation and the potential for unauthorized root-level command execution through malicious email processing, organizations should prioritize patching over relying solely on network controls or monitoring. Cisco strongly recommends migrating to the latest product version, 16.5.0-780.

For further remediation guidance, refer to the vendor’s advisory.

Indicators of Compromise

To identify potential exploitation attempts of CVE-2026-76461, organizations should review mail logs for suspicious SQL statements. If the device is part of a cluster, logs from each cluster device should also be examined. A non-exhaustive example of a malicious SQL statement that could be detected in the logs is:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

Any entries in the output may indicate malicious activity.

For customers using Exposure Command, InsightVM, and Nexpose, vulnerability checks for CVE-2026-76461 are expected to be available in the September 16 content release.