Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)

Attackers have leveraged a zero-day SQL injection vulnerability (CVE-2026-76461) to compromise Cisco Secure Email Gateway appliances, Cisco confirmed on Monday.

The vendor’s Product Security Incident Response Team became aware of active exploitation of this vulnerability in September 2025, and has shared indicators of compromise that organizations can look for to check whether they’ve been hit.

About CVE-2026-76461

The vulnerability affects versions 16.5, 16.0, and 15.5 and earlier of Cisco AsyncOS Software, running on on-premises physical and virtual Secure Email Gateway appliances.

It also affected the cloud-delivered version of Cisco’s Secure Email Gateway – Cisco Secure Email Cloud – and Cisco said it “has directly contacted customers who own Cisco Secure Email Cloud devices on which malicious activity was detected.”

The flaw is due to insufficient validation in the email parsing logic, and can be triggered by an unauthenticated attacker sending a crafted email message that contains malicious SQL statements through an affected device.

Successful exploitation does not hinge on user interaction.

What to look for?

“A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system,” Cisco explained.

The vendor advised organizations using Cisco Secure Email Gateway check the devices’ mail_logs for suspicious SQL statements.

“The presence of any entry in the output may indicate malicious activity. If the device is part of a cluster, review the logs of each cluster device,” Cisco added.

But, it also noted that since threat actors may obtain command execution with root privileges, they may use this access to delete/hide evidence of exploitation and indicators of compromise.

(Late last year, for example, a suspected Chinese-nexus threat group used log-purging tools after planting backdoors following zero-day exploitation of CVE-2025-20393.)

“Cisco strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses,” the company noted.

What to do?

Cisco has already upgraded all Cisco Secure Email Cloud devices to Release 16.5.0-780.

To plug CVE-2026-76461, Cisco recommends enterprise admins to upgrade their devices to a fixed release: 15.5.5-014, 16.0.4-302, or 16.5.0-780 (the latter is preferred). 15.5.5-014 and 16.5.0-780 are also software hardening releases, and carry fixes for a slew of additional critical vulnerabilities that were discovered by the vendor.

After the upgrade, security teams should search for the presence of indicators of compromise in various logs. If found, they should either:

• Contact the Cisco Technical Assistance Center (TAC) for support (if they are running physical devices)
• Record forensics information, deploy a new virtual machine running one of the fixed software releases, rebuild the product configuration, renew credentials and any cryptographic materials that are installed on the appliance, and continue to monitor the system for anomalous behavior.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on Monday, and ordered US federal civilian agencies to remediate the flaw by Thursday (September 17) and check for evidence of compromise.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!