Cisco has published an advisory about a critical vulnerability CVE-2026-76461 in AsyncOS software for Cisco Secure Email Gateway. The vulnerability is a SQL injection (CWE-89), has a CVSS score of 9.8 out of 10, and according to Cisco is already being actively exploited by attackers. Insufficient validation in the email parsing logic allows an unauthenticated remote attacker to send a specially crafted email containing malicious SQL statements and achieve arbitrary command execution with root privileges on the underlying operating system. There are no workarounds — the only mitigation is to update to a fixed version. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline for U.S. federal agencies set to 17 September 2026.
Technical details of the vulnerability
The CVE-2026-76461 vulnerability affects all Cisco Secure Email Gateway appliances — both physical and virtual — regardless of configuration. This means that no device settings can reduce the risk without applying the patch.
The attack vector is noteworthy for its simplicity: the attacker only needs to send a specially crafted email through the vulnerable appliance. The email contains malicious SQL statements which, due to insufficient validation in the email parser, are processed by the system. Successful exploitation leads to the execution of arbitrary SQL queries, which in turn allows execution of operating system commands with root privileges.
Cisco emphasizes that the following products are not affected:
- Secure Email and Web Manager
- Secure Web Appliance
This is an important clarification for organizations using multiple Cisco products in their email security infrastructure: asset inventories must clearly distinguish between these product lines. Previously we have already written about another vulnerability affecting Cisco hardware.
Fixed versions
Cisco has released updates for all affected AsyncOS branches:
- 15.5 and earlier — fixed in version 15.5.5-0141
- 16.0 — fixed in version 16.0.4-302
- 16.5 — fixed in version 16.5.0-780
The company explicitly states: there are no workarounds that eliminate the vulnerability. The only recommendation is to update to a fixed version.
Detection and response
Obtaining root access allows attackers to delete or hide traces of compromise directly on the appliance. Cisco explicitly warns about this in its advisory, and it significantly complicates incident investigations. This is why the investigation should not be limited to analyzing the device’s own logs — external telemetry sources must be leveraged.
Cisco recommends the following steps to detect possible compromise:
- Check the
mail_logsfiles for suspicious SQL statements - If the appliance is part of a cluster, analyze the logs of every device in the cluster
- Run the following command to search for malicious SQL constructs:
grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs] - Any match in the output may indicate malicious activity
In addition to the appliance’s local logs, administrators should review network logs and firewall logs for signs of anomalous activity: unexpected outbound data transfers from the affected appliance to external IP addresses or inbound connections from suspicious addresses. This is critically important precisely because an attacker with root privileges can clean up local traces.
Cisco also reported that it directly notified customers using Cisco Secure Email Cloud whose appliances showed signs of malicious activity. The company has not disclosed the scale of the attacks.
Large-scale attacks on Fortinet VPN
In parallel with Cisco’s disclosure, Arctic Wolf reported a large-scale credential-stuffing campaign targeting internet-exposed Fortinet VPN appliances. According to the researchers, the attacks occurred in two waves between 26 and 28 August 2026 and generated tens of millions of failed authentication attempts.
A characteristic feature of the campaign is the use of non-random logins, but rather purposefully selected identifiers: employee names, corporate email addresses, partner accounts, and typical administrative accounts for specific organizations. In Arctic Wolf’s assessment, this indicates prior collection or enumeration of identity data rather than simple brute force.
In one observed case, as Arctic Wolf reports, a successful Fortinet VPN authentication from IP address 158[.]94[.]211[.]14 was recorded immediately before malicious activity in the compromised environment.
It should be stressed: no link has been established between the campaign against Fortinet VPN and the exploitation of CVE-2026-76461 in Cisco Secure Email Gateway — these are two separate incidents that happened to coincide in time. None of the referenced sources identify the threat actor behind them or indicate any shared infrastructure. We previously covered other vulnerabilities in Fortinet products.
Recommendations
Organizations using Cisco Secure Email Gateway should:
- Immediately update AsyncOS to a fixed version (15.5.5-0141, 16.0.4-302, or 16.5.0-780, depending on the branch in use)
- Perform a retrospective analysis of
mail_logsusing the patternCOPY.*TO PROGRAMto identify possible exploitation before the patch was applied - Review external telemetry — firewall and network equipment logs — for anomalous outbound connections from affected appliances
- Conduct an inventory to accurately determine which appliances are Secure Email Gateway and which belong to the non-vulnerable Secure Email and Web Manager or Secure Web Appliance lines
Given the confirmed active exploitation, the CVSS score of 9.8, the absence of workarounds, and the fact that the attack requires only sending an email without any authentication, updating Cisco Secure Email Gateway to a fixed AsyncOS version must be the top priority for all affected organizations. For U.S. federal agencies, the CISA KEV catalog sets a deadline of 17 September 2026, but commercial organizations should not use this date as a benchmark: every day without a patch is an open window for an unauthenticated remote attack that grants full control over the appliance.
