Cisco Secure Email Gateway SQL Injection CVE-2026-76461: Exploited Flaw Gives Root From One Email, and the Fixed Versions to Install

Cisco has updated its warning about CVE-2026-76461, a critical flaw in Cisco Secure Email Gateway. An attacker can run commands as root on the appliance just by sending it a specially crafted email. Attackers have been using it since September, Cisco now says exploit code is available online, and on November 3 Cisco changed its fix guidance for older 15.5 releases. If your company's mail passes through one of these appliances, check it this week.

What happened with Cisco Secure Email Gateway CVE-2026-76461

Cisco published advisory cisco-sa-esa-inj-2bLVGmhX on Monday, September 14, 2026. The bug is in the email parsing code of Cisco AsyncOS Software, the operating system that runs Secure Email Gateway (many IT teams still call it Cisco ESA or IronPort). Cisco says the software does not properly validate parts of incoming email. An attacker can send a message containing malicious SQL statements, and those statements can end up running commands on the underlying operating system with root privileges.

Cisco rates it 9.8 out of 10 (Critical). The scoring says the attack works over the network, is low in complexity, needs no account and needs no user interaction. Nobody has to open or click anything. The gateway processes the message itself, and that processing is where the attack happens.

What is confirmed and what is not

Confirmed by Cisco's advisory and CISA's catalog:

• Cisco's security team (PSIRT) became aware of active exploitation in September 2026.
• CISA lists the flaw as known exploited, added September 14, 2026. CISA marks ransomware use as "Unknown."
• Physical and virtual Secure Email Gateway appliances are affected regardless of device configuration. There is no setting that makes you safe.
• Secure Email and Web Manager and Secure Web Appliance are not affected.
• There is no workaround. Fixed software is the only remedy.
• Cisco says it has already upgraded all Cisco Secure Email Cloud devices to 16.5.0-780. It says it directly contacted only those Secure Email Cloud customers whose devices showed indicators of possible compromise, not every cloud customer.
• Cisco found the flaw while resolving a Cisco TAC support case.

Not known from the primary sources:

• Who is behind the attacks. Cisco's advisory does not name a group.
• How many appliances have been compromised.
• What the exploit code "available online" is. Cisco mentions it but does not describe or link to it.

News coverage has added extra details. We stuck to what Cisco and CISA have published.

Why an email gateway flaw matters for a business network

An email gateway is built to accept mail from anyone on the internet. You cannot fix this by blocking strangers, because receiving mail from strangers is the gateway's job. That makes it one of the most exposed systems a company owns.

It also sees everything: invoices, contracts, password reset links and attachments. An attacker with root on that box can read or change mail and use it as a foothold into the internal network. Cisco also warns that an attacker with root may remove or hide evidence on the device. So a clean-looking appliance is not proof of a clean appliance.

Clusters raise the stakes. Cisco says clustered gateways use SSH key pairs to authenticate to each other, and an attacker who exploits one member could get those private keys and use them against the others. Cisco strongly recommends restoring every member of a cluster that has at least one compromised appliance.

This is a separate flaw from CVE-2026-76519, the exploited path traversal bug Cisco disclosed on October 14, exactly one month later. We covered that one in Cisco Secure Email Gateway Vulnerability CVE-2026-76519. Check each advisory on its own. Handling one does not mean you have handled the other.

Cisco Secure Email Gateway fixed versions

Cisco strongly recommends that anyone on a release earlier than 16.5 move to 16.5.0-780. Cisco says that release fixes the flaw regardless of the Cisco Retro Remediation Engine version. If you stay on 15.5.x, Cisco says to run the retroscannerstatus command and confirm the Retro Remediation Engine is version 4.0.2 or later. The appliance reboots after an upgrade, so schedule a mail window.

What to do this week

1. Find every gateway. List each physical and virtual Secure Email Gateway, including every cluster member, and compare its AsyncOS release to the table above.
2. Upgrade. In the web interface: System Administration, then System Upgrade, then Upgrade Options, then Download and Install. On the command line: run upgrade, enter DOWNLOADINSTALL and choose the release.
3. Check the engine on 15.5.x. Run retroscannerstatus and confirm version 4.0.2 or later.
4. Search the mail logs. Cisco's example is grep -i "COPY.*TO PROGRAM" run against the IronPort Text Mail Logs (default name: mail_logs). Cisco says any entry may indicate malicious activity, and that this check is not exhaustive.
5. Look outside the box. Review firewall and network logs for unexpected uploads to external IP addresses or downloads from malicious ones, since the appliance's own logs may have been cleaned.
6. If you suspect compromise: for physical appliances, contact Cisco TAC and keep remote access enabled for the investigation. For virtual appliances, preserve forensic data first, because a new instance wipes configuration and logs. Then deploy a new VM on a fixed release, rebuild the configuration, and renew credentials and cryptographic material.
7. Lock down management. Block internet access to the appliance where you can, or allow only trusted hosts on the required ports. Put mail and management on separate interfaces, filter management traffic through a firewall, turn off HTTP and FTP if you do not need them, change the default admin password, use role-based accounts and send logs to an external server.
8. Cloud customers: Cisco has upgraded your devices. If Cisco contacted you, renew credentials and cryptographic material.

If you run Snort, Cisco lists rules 3:67109 and 3:67110 for this flaw.

Cisco Secure Email Gateway vulnerability questions people are asking

Is CVE-2026-76461 being exploited?

Yes. Cisco says it became aware of active exploitation in September 2026, and CISA lists it as a known exploited vulnerability.

Does someone have to open the malicious email?

No. The gateway itself processes the crafted message. No user interaction is needed.

Is there a workaround for CVE-2026-76461?

No. Cisco says there are no workarounds. Install a fixed release.

Which Cisco AsyncOS version should I install?

Cisco recommends 16.5.0-780. The minimum fixed releases are 15.5.5-014, 16.0.4-302 and 16.5.0-780.

I am on 15.5.5-014. Am I safe?

Not automatically. Cisco updated that fix on October 31. Run retroscannerstatus and confirm the Retro Remediation Engine is 4.0.2 or later, or move to 16.5.0-780.

Is Cisco Secure Email Cloud affected?

Cisco says it has upgraded all Secure Email Cloud devices to 16.5.0-780, and it has contacted customers whose devices showed indicators of possible compromise.

Are Secure Email and Web Manager or Secure Web Appliance affected?

No. Cisco lists both as not vulnerable.

Does patching remove an attacker who is already in?

Not on its own. Cisco gives separate recovery steps for compromised devices: log checks, rebuilds and renewing credentials and keys.

The bigger lesson

Security appliances are internet-facing software too, and the email gateway is the most exposed of them all. It needs the same fast patching, log review and locked-down management as any server, plus someone who reads the advisory again when the vendor updates it. A fix that was right in September may need rechecking in November.

Want help reviewing your edge devices? See our security hardening service or request a tech quote.

Get alerts like this by email, with our free checklist, at EPE security alerts.

Sources: Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX; CISA Known Exploited Vulnerabilities Catalog.