Cisco Secure Email Gateway SQL injection CVE-2026-76461 exploited; fixes released, no workaround
Cisco Secure Email Gateway flaw CVE-2026-76461 (CVSS 9.8) lets an unauthenticated attacker gain root with a crafted email, and is being used in attacks. Fixed in 15.5.5-014, 16.0.4-302 and 16.5.0-780. No workaround. Businesses running the appliance should update now.
If your organisation runs a Cisco Secure Email Gateway, update to 15.5.5-014, 16.0.4-302 or 16.5.0-780 (16.5.0-780 preferred) and check the mail logs for suspicious SQL. Home users have nothing to do.
What’s happening
CVE-2026-76461 is a critical SQL injection (CVSS 9.8) in Cisco AsyncOS for Cisco Secure Email Gateway, the physical or virtual appliance many organisations use to filter incoming email. Cisco says an attacker with no login can send a crafted email containing malicious SQL and end up running commands as root on the device. It affects every configuration. Cisco's advisory, published on 14 September 2026, says its security team learned of active exploitation in September, and CISA listed the flaw as exploited the same day. The flaw came to light during a Cisco support case. Cisco has fixed releases for each branch: 15.5.5-014 (for 15.5 and earlier), 16.0.4-302 and 16.5.0-780. It strongly recommends moving older releases to 16.5.0-780. There is no workaround. Secure Email and Web Manager and Secure Web Appliance are not affected, and Cisco has already upgraded Secure Email Cloud. On 17 September Cisco added advice for clusters: restore every member if one is compromised. On 3 November it updated the 15.5.5-014 entry and marked the advisory final.
- What
- Flaw
- Affects
- Cisco Secure Email Gateway (AsyncOS), physical and virtual
- Affected
- Cisco Secure Email Gateway releases 15.5 and earlier
Cisco Secure Email Gateway 16.0
Cisco Secure Email Gateway 16.5 - Fixed in
- 15.5.5-014 (for 15.5 and earlier)
16.0.4-302
16.5.0-780 - Since
- 14 Sept 2026
Timeline
- Vendor revisedFixed
Cisco revised the advisory (version 1.2, status Final) with updated information on release 15.5.5-014 for the 15.5-and-earlier branch. Cisco says to confirm the Retro Remediation Engine is version 4.0.2 or later, and strongly recommends moving pre-16.5 systems to 16.5.0-780.
- Vendor revised
Cisco added a note for clustered appliances: a compromised appliance could expose the SSH keys cluster members use with each other, so every member of an affected cluster should be restored.
- Made publicFixed
Cisco published advisory cisco-sa-esa-inj-2bLVGmhX for CVE-2026-76461, a critical SQL injection in Secure Email Gateway that gives an unauthenticated attacker root access through a crafted email. Cisco said it knew of active exploitation from September 2026, offered no workaround, and listed fixed releases 15.5.5-014, 16.0.4-302 and 16.5.0-780. CISA listed the flaw as exploited the same day.
Sources
- Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX)Cisco · 3 Nov 2026