CISA Orders Federal Agencies to Patch an Actively Exploited Cisco Email Gateway Flaw by September 17

Cisco has confirmed that attackers are actively exploiting a maximum-severity vulnerability in its Secure Email Gateway appliances that lets an unauthenticated attacker seize root control of the underlying operating system, triggered by nothing more than a single crafted email. The flaw, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of 10, and the U.S. Cybersecurity and Infrastructure Security Agency has added it to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until September 17, just three days from disclosure, to patch.

How a Single Email Becomes Root Access

Cisco Secure Email Gateway (the product line formerly sold as IronPort) is an email security appliance, available as both physical and virtual hardware, that inspects incoming mail for spam, malware, and other threats before it reaches an organization’s mail servers. According to Cisco’s advisory, the vulnerability sits in how the gateway’s AsyncOS software parses email content: “This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device.” Cisco added that “a successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.”

In practice, that means the appliance’s own email parser hands attacker-controlled content to a SQL backend without adequate sanitization, a classic SQL injection flaw (tracked under CWE-89) with an unusually severe outcome: instead of just manipulating a database, the injected statements let an attacker run arbitrary operating-system commands as root. The CVSS vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, explains why the score maxes out at 9.8: the attack is reachable over the network, needs low complexity and no privileges, and requires no user interaction at all. A vulnerable device just has to receive the email.

What’s Fixed, and What Still Needs Patching

The vulnerability affects Cisco Secure Email Gateway, both physical and virtual appliances, “regardless of device configuration.” Cisco confirmed its separate Secure Email and Web Manager and Secure Web Appliance products are not affected. There are no workarounds; the only remediation is to upgrade. Cisco’s advisory lists fixed releases for every affected branch: 15.5.5-014 for 15.5 and earlier, 16.0.4-302 for the 16.0 branch, and 16.5.0-780 for 16.5, with Cisco specifically recommending customers migrate to 16.5.0-780. The company said it has already upgraded every Secure Email Cloud device to that release on customers’ behalf.

CVE-2026-76461 was not the only Secure Email Gateway bug Cisco patched on Monday, as BleepingComputer first noted. In a companion advisory, Cisco said an internal security review of its email security products turned up five more vulnerabilities (CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, and CVE-2026-76443), grouped by weakness class and spanning path traversal, improper access control, and other bug categories across both Secure Email Gateway and Secure Email and Web Manager. Four of the five carry the same maximum 9.8 score as the actively exploited bug; the fifth, CVE-2026-76442, rates a still-serious 7.5. Unlike CVE-2026-76461, which Cisco’s own Technical Assistance Center found while responding to a live customer incident, the company said these five were caught internally during testing, and it has not seen evidence that any of them are being exploited. Given the company’s recent history with this product line, though, that gap may not last.

How Cisco Found It, and How Admins Can Check for Compromise

Cisco said the bug “was found during the resolution of a Cisco TAC support case,” not through an outside researcher or a bug bounty submission, and that its Product Security Incident Response Team became aware of active exploitation “in September 2026.” The company has not disclosed who is behind the attacks or how many organizations have been compromised, though it said it has directly contacted Secure Email Cloud customers whose devices showed signs of malicious activity.

For self-managed appliances, Cisco published an indicator of compromise: administrators should review each device’s mail_logs, and every device in a cluster, since Secure Email Gateway appliances are often deployed in clusters, for suspicious SQL statements using a command like cisco-esa> grep -i "COPY.*TO PROGRAM" mail_logs. Cisco included an important caveat, though: because a successful exploit hands the attacker root privileges, “evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors.” The company recommended cross-checking firewall and network logs outside the affected device itself, specifically for unexpected uploads to, or downloads from, external IP addresses, since a root-level attacker can simply delete the local logs an admin would otherwise check first.

The security research group Shadowserver said it currently tracks more than 400 internet-exposed Cisco Secure Email Gateway appliances, though it did not specify how many of those are honeypots or have already been secured against attacks.

The Second Zero-Day in Cisco’s Email Security Line

As SecurityWeek noted, CVE-2026-76461 is only the second Secure Email Gateway vulnerability Cisco has had added to CISA’s KEV catalog. The first, CVE-2025-20393, was a maximum-severity AsyncOS flaw that China-linked threat actors exploited in zero-day attacks against Secure Email Gateway and Secure Email and Web Manager devices starting in November 2025, months before Cisco patched it in January 2026. The recurrence, a second unauthenticated, pre-patch compromise of the same product line within a year, points to Cisco’s flagship email security appliance as a standing target for attackers who know a fix will eventually arrive but can extract value from the window before it does.

The pattern is not limited to email security. Earlier this month, Cisco and CISA separately warned that two vulnerabilities in Cisco Secure Firewall Management Center, CVE-2026-20079 and CVE-2026-20316, have been exploited by both Russian state-sponsored hackers and financially motivated cybercriminals. And in August, sxz.io covered a CISA deadline for an actively exploited denial-of-service flaw in Cisco’s ASA and FTD firewalls, a different product line but the same underlying dynamic: perimeter security appliances from a single vendor drawing sustained, overlapping attacker interest across several product families in the same year.

What Admins Should Do Now

There is no workaround for CVE-2026-76461, so the only real mitigation is upgrading to a fixed release, and that applies even to organizations that see no sign of compromise yet, since Cisco has not disclosed the scope of current attacks. With five more critical or high-severity bugs disclosed in the companion hardening advisory and not yet confirmed exploited, admins should treat both advisories as urgent rather than patching only the CVE making headlines. Anyone running Secure Email Gateway should check mail_logs across every device in a cluster for the SQL-injection pattern Cisco published, then separately audit firewall and network logs for outbound traffic to unfamiliar IP addresses, since a compromised device’s own local logs cannot be trusted once an attacker has root.