Cisco Email Gateway CVE-2026-76461: the email is the exploit

The appliance that filters your spam can be owned by an email. CVE-2026-76461 is a SQL injection flaw in Cisco Secure Email Gateway that lets an unauthenticated attacker on the internet run arbitrary commands as root — by sending a message through the gateway. CVSS 9.8. Cisco's PSIRT says it is being exploited right now. CISA added it to the Known Exploited Vulnerabilities catalog on September 14. There is no workaround.

What actually happened

Per Cisco's advisory, published September 14, the bug is insufficient validation in the email parsing logic of AsyncOS Software. An attacker embeds SQL statements in an inbound message; the appliance processes the message, executes the statements, and the attacker ends up with root on the underlying operating system. No credentials. No user interaction. Nobody has to click anything — the gateway does the work by doing its job.

Both physical and virtual Secure Email Gateway deployments are affected, across AsyncOS releases 15.5 and earlier, 16.0, and 16.5. The fixed builds are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Cisco states plainly that there are no workarounds that address this vulnerability, and that in September 2026 it became aware of active exploitation.

That combination — pre-auth, root, exploited, no mitigation — is the worst shape a vulnerability comes in. CISA's KEV listing on September 14 is the confirmation, not the news.

Why this Cisco email gateway flaw matters for your business

The delivery mechanism is the problem. Most edge-device bugs require the attacker to reach a management port, a VPN endpoint, or an admin panel — things you can firewall. This one requires the attacker to send you email. Your mail gateway is, by design, listening to the entire internet and accepting hostile input from strangers. You cannot rate-limit your way out of it or put it behind a VPN. The exposure is the function.

Root on the gateway is root on your mail. Think about what that box sees: every inbound and outbound message, the routing config, often the credentials it uses to talk to your mail platform, and the TLS keys for the domains it fronts. An attacker with root there can read mail, silently forward it, disable filtering for their own follow-up phishing, or sit quietly and collect. There's no encryption boundary that saves you — the gateway decrypts to inspect.

Most small businesses don't know they have one. If you're on Microsoft 365 or Google Workspace with no appliance in front, this isn't your problem. If an MSP, a compliance vendor, or an inherited on-prem setup put a Cisco ESA in your mail path, it is. Check your domain's MX records and the mail headers of a recent inbound message — the appliance usually names itself in the Received: chain. That's a five-minute check and it settles the question.

Ask two questions in writing today. What AsyncOS build is running, and when does it get patched. Not "are we covered" — the version string. Vendors are much more precise when the answer has to be typed into an email. And because Cisco published no indicators of compromise, you cannot verify you weren't hit. You can only verify you're patched, which makes the patch date the only number that means anything.

Sources: Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX, CISA Known Exploited Vulnerabilities Catalog.