Cisco has disclosed a critical vulnerability affecting Secure Email Gateway appliances running AsyncOS. The flaw is tracked as CVE-2026-76461 and carries a CVSS score of 9.8. Attackers are already exploiting the vulnerability in active attacks.
How the Cisco Vulnerability Works
Attackers can exploit the flaw by sending a specially crafted email through the gateway. The email can contain malicious SQL statements targeting vulnerable AsyncOS systems. Successful exploitation can give attackers root-level command execution.
No authentication is required to exploit this vulnerability. Users also do not need to open the malicious email. The gateway processes the attack while handling incoming email traffic.
Why This Vulnerability Is Serious
Email gateways often sit between the internet and an organization’s internal systems. They inspect messages for phishing, malware, spam, and other threats. Compromising that gateway can create significant security risks.
Root access gives attackers extensive control over the affected appliance. Attackers could also hide evidence after successfully compromising the device. That makes normal system logs less reliable during investigations.
Cisco Confirms Active Exploitation
Cisco became aware of active exploitation during September 2026. CISA also added the vulnerability to its Known Exploited Vulnerabilities catalog. Organizations should treat this issue as an urgent security concern.
Cisco published an official security advisory with remediation guidance and fixed software releases.
Affected Cisco Secure Email Gateways
The vulnerability affects physical and virtual Cisco Secure Email Gateway appliances. Affected systems remain vulnerable regardless of their specific device configuration. Cisco Secure Email and Web Manager is not affected.
Cisco Secure Web Appliance is also not affected by this vulnerability. Organizations should still verify their exact products and installed AsyncOS versions.
Cisco Releases Security Updates
Cisco has released updated AsyncOS versions addressing CVE-2026-76461. There are currently no workarounds that completely address the vulnerability.
AsyncOS 15.5 users should upgrade to version 15.5.5-014 or later. AsyncOS 16.0 users should install version 16.0.4-302 or later. AsyncOS 16.5 users should install version 16.5.0-780.
Cisco strongly recommends migrating affected systems to AsyncOS version 16.5.0-780. Organizations should prioritize updates instead of waiting for normal maintenance schedules.
Check Systems for Possible Compromise
Installing the update addresses the vulnerability but may not remove an existing compromise. Administrators should investigate systems for evidence of previous exploitation.
Cisco recommends reviewing mail logs for suspicious SQL statements. Clustered environments should have logs reviewed across every gateway appliance.
Administrators should also examine external firewall and network logs. Attackers with root privileges could remove evidence stored locally. External logs may reveal suspicious downloads, uploads, or outbound connections.
What Businesses Should Do Now
Organizations using Cisco Secure Email Gateway should immediately verify their installed AsyncOS version. Vulnerable systems should receive an appropriate security update as soon as possible.
Businesses should also preserve logs before making major system changes. Security teams should investigate unusual activity surrounding affected gateways.
Suspected virtual appliance compromises may require rebuilding the affected virtual machine. Credentials, certificates, and cryptographic materials may also require replacement.
Emergency IT Support Can Help
Critical vulnerabilities can quickly become major business disruptions. Fast investigation can help determine whether systems were exposed or compromised.
Next Phase Tech Partners provides emergency IT support for Chicago businesses facing urgent technology and cybersecurity problems.
