Cisco Secure Email Gateway AsyncOS SQL Injection Remote Code Execution

CVE-2026-76461 (referenced by the user as CVE-2026-76460) is an unauthenticated SQL injection in the email-parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway. An attacker sends a crafted email through the gateway; the parsing engine feeds attacker-controlled content directly into a database query without sanitization. Successful exploitation chains the SQL injection into arbitrary command execution with root privileges on the underlying OS. Affected versions: AsyncOS 15.5 and all earlier releases, 16.0, and 16.5. Both physical and virtual appliance form factors are vulnerable. Fixed in 15.5.5-0141, 16.0.4-3021, and 16.5.0-780.

Cisco assigned this a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — and for once the vendor score undersells nothing. The attack requires zero authentication, zero user interaction, and uses the email delivery path itself as the weapon. The gateway *must* process inbound mail to do its job — you cannot firewall the attack surface without disabling the product. Cisco PSIRT confirmed active zero-day exploitation prior to disclosure. CISA added it to KEV on September 14, 2026, with a federal remediation deadline of September 17, 2026 — three calendar days. There are no workarounds. This is as bad as email infrastructure vulnerabilities get.

Why this verdict

• Unauthenticated remote attack via email delivery: The attacker needs nothing — no credentials, no user interaction, no internal access. Sending an email is sufficient. This eliminates every friction point that normally tempers network-accessible vulnerabilities.
• Role multiplier: Cisco Secure Email Gateway is a canonical network-edge email security appliance. By definition, 100% of deployments are internet-facing on the MX path. Root compromise yields: interception of all organizational email (domain-scale data breach), injection of malicious content into outbound mail (supply-chain/phishing pivot), credential harvesting from password resets and MFA tokens, and lateral movement via management network. Blast radius is organization-wide to supply-chain-scale. The verdict floor is CRITICAL.
• Active zero-day exploitation + KEV listing: Cisco confirmed exploitation before disclosure. CISA set a 3-day federal deadline (September 17, 2026). This is not a theoretical risk — threat actors are already inside gateways running vulnerable AsyncOS.
• No workarounds exist: Cisco explicitly states there are no configuration changes or mitigations short of patching. The product cannot be reconfigured to avoid the vulnerable code path while still functioning as an email gateway.

Why not higher?

There is no severity bucket above CRITICAL. A 9.8 CVSS with confirmed zero-day exploitation, no authentication requirement, no workarounds, and internet-facing-by-design attack surface represents the ceiling of practical vulnerability severity.

Why not lower?

Downgrading would require identifying meaningful friction in the attack path, but there is none. The attacker sends an email — the most common and unrestricted network action on the internet. The target processes it automatically. The result is root. The product is internet-facing by architectural necessity. Active exploitation removes any remaining ambiguity about exploitability. The deployment-role floor for network-edge appliances with organization-wide blast radius is CRITICAL, and no friction point exists to challenge it.

1. Patch immediately to AsyncOS 15.5.5-0141, 16.0.4-3021, or 16.5.0-780 — There are no workarounds — patching is the only remediation. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days (by September 20, 2026). Given active exploitation and CISA's September 17 federal deadline, treat this as an emergency change window.
2. Monitor mail logs for SQL injection artifacts — Search AsyncOS mail logs for patterns matching COPY.*TO PROGRAM, pg_sleep, UNION SELECT, or other SQL keywords in message metadata fields. This is a detection-only control — it does not prevent exploitation but identifies if you have already been compromised.
3. Conduct forensic triage on all Secure Email Gateway appliances — Given confirmed zero-day exploitation, assume compromise until proven otherwise. Check for: unauthorized SSH keys in /root/.ssh/, unexpected cron entries, modified system binaries (compare hashes to known-good images), and anomalous outbound network connections from the appliance.
4. Rotate credentials accessible from the gateway — If compromise is suspected or confirmed, rotate: appliance admin credentials, LDAP bind credentials configured for directory integration, any API keys or service account passwords stored on or accessible from the gateway, and email-based password reset tokens issued during the exposure window.
5. Isolate management interfaces — Ensure the AsyncOS management interface (HTTPS/SSH) is on a dedicated management VLAN, not accessible from the general network. This limits post-compromise lateral movement but does NOT prevent the initial exploit via the SMTP data path.

Run this on each Cisco Secure Email Gateway appliance via SSH as an admin user. It checks the running AsyncOS version against known-patched releases. Example: ssh [email protected] then paste the script, or use ssh [email protected] 'bash -s' < check_seg_cve.sh.

#!/bin/bash
# CVE-2026-76461 (user ref: CVE-2026-76460) — Cisco Secure Email Gateway AsyncOS version check
# Run on the appliance via SSH as admin
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

VERSION=$(version 2>/dev/null | grep -oP 'AsyncOS\s+\K[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' | head -1)

if [ -z "$VERSION" ]; then
  # Try alternative method
  VERSION=$(cat /data/.version 2>/dev/null || echo "")
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine AsyncOS version. Verify manually."
  exit 2
fi

echo "Detected AsyncOS version: $VERSION"

MAJOR=$(echo "$VERSION" | cut -d'.' -f1)
MINOR=$(echo "$VERSION" | cut -d'.' -f2)
PATCH=$(echo "$VERSION" | cut -d'.' -f3 | cut -d'-' -f1)
BUILD=$(echo "$VERSION" | cut -d'-' -f2)

# Patched versions: 15.5.5-0141+, 16.0.4-3021+, 16.5.0-780+
if [ "$MAJOR" -gt 16 ]; then
  echo "PATCHED — Version $VERSION is beyond affected range."
  exit 0
elif [ "$MAJOR" -eq 16 ] && [ "$MINOR" -eq 5 ]; then
  if [ "$PATCH" -gt 0 ] || [ "$BUILD" -ge 780 ]; then
    echo "PATCHED — Version $VERSION includes the fix (>= 16.5.0-780)."
    exit 0
  fi
elif [ "$MAJOR" -eq 16 ] && [ "$MINOR" -eq 0 ]; then
  if [ "$PATCH" -gt 4 ] || ([ "$PATCH" -eq 4 ] && [ "$BUILD" -ge 3021 ]); then
    echo "PATCHED — Version $VERSION includes the fix (>= 16.0.4-3021)."
    exit 0
  fi
elif [ "$MAJOR" -eq 15 ] || ([ "$MAJOR" -lt 15 ]); then
  if [ "$MAJOR" -eq 15 ] && [ "$MINOR" -eq 5 ] && [ "$PATCH" -ge 5 ]; then
    if [ "$BUILD" -ge 141 ] 2>/dev/null || [ "$BUILD" -ge 0141 ] 2>/dev/null; then
      echo "PATCHED — Version $VERSION includes the fix (>= 15.5.5-0141)."
      exit 0
    fi
  fi
fi

echo "VULNERABLE — Version $VERSION is affected by CVE-2026-76461. Patch immediately."
echo "Also check for compromise indicators: grep -i 'COPY.*TO PROGRAM' /data/log/mail_logs/*"
exit 1

Sources

1. Cisco Security Advisory: cisco-sa-esa-inj-2bLVGmhX
2. CISA KEV Alert — September 14, 2026
3. Rapid7 Emergent Threat Response: CVE-2026-76461
4. The Hacker News: Cisco Secure Email Gateway Flaw Exploited
5. CyberSecurity News: Cisco Secure Email Gateway Flaw Exploited
6. CyCognito Emerging Threat Analysis
7. eSecurity Planet: Cisco Secure Email Gateway Zero-Day