CVE-2026-76461 · Cisco AsyncOS Software for Secure Email Gateway SQL Injection to…

01 · The Real Story

Your mail scanner has a door that opens from the outside

CVE-2026-76461 is a SQL injection in the email-parsing pipeline of Cisco AsyncOS Software for Cisco Secure Email Gateway. When the appliance processes an inbound message, it executes SQL statements against an internal PostgreSQL database to track message-handling metadata. The parsing logic fails to sanitize attacker-controlled fields in the email envelope and headers. By embedding SQL control characters in a crafted email, an attacker causes the gateway to execute arbitrary SQL — which chains into OS command execution via PostgreSQL's COPY ... TO PROGRAM primitive, running as root. Affected versions span AsyncOS 15.5 and all earlier releases, 16.0.x, and 16.5.x. Both physical appliances and virtual deployments are vulnerable. Cisco Secure Email Cloud tenants were remediated server-side.

Cisco's CRITICAL 9.8 rating is dead-on accurate. This is an unauthenticated, zero-click, network-reachable vulnerability that grants root-level command execution on an appliance whose entire job is to sit in front of your mail flow and accept untrusted input from the internet. Every friction factor works in the attacker's favor: no credentials needed, no user interaction, no special configuration, and the attack surface — SMTP email processing — is universally exposed by design. Exploitation was confirmed in the wild before disclosure, CISA added it to KEV the same day with a 3-day remediation deadline for federal agencies, and no workaround exists. The vendor severity matches reality perfectly.

"One crafted email gets root on your mail gateway. No auth, no click, no workaround. Patch now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Craft malicious email with SQLi payload

The attacker constructs an email with a SQL injection payload embedded in a parsed header field (e.g., Subject, From, or MIME boundary). The payload contains PostgreSQL-specific syntax targeting the metadata-tracking queries that AsyncOS runs during message ingestion. No tooling beyond a standard SMTP client or scripting language is needed. The injection point is derivable from the advisory description and patch diff analysis.

Conditions required:

Knowledge of the SQLi injection point (derivable from advisory and patch diff)
Ability to send email via SMTP (universally available)

Where this breaks in practice:

None — crafting a malicious email is trivial for any attacker with SQLi experience

Detection/coverage: No public Snort/Suricata signatures at time of disclosure; Cisco Talos rules expected but not yet confirmed.

STEP 02

Deliver via SMTP to target gateway

The attacker sends the crafted email to any address whose MX record points to the vulnerable Cisco Secure Email Gateway. The email traverses normal SMTP delivery; no management-plane access, VPN, or internal network position is required. The gateway processes the message as part of its core function — accepting and scanning inbound email from the internet.

Conditions required:

Target organization uses Cisco Secure Email Gateway
Gateway accepts inbound email (the default and only useful posture)

Where this breaks in practice:

Zero — the appliance exists to accept untrusted email from the internet

Detection/coverage: Upstream email security (if any exists before the Cisco gateway) would need to detect SQL injection patterns in email headers, which is not a standard capability.

STEP 03

SQL injection executes during email parsing

AsyncOS parses the email and interpolates attacker-controlled data into SQL statements against its internal PostgreSQL database without proper sanitization. The injected SQL executes in the context of the database service. This is the default code path for every single inbound message — there is no optional feature or configuration that gates this behavior.

Conditions required:

Gateway is running an affected AsyncOS version (15.5.x or earlier, 16.0.x, 16.5.x)

Where this breaks in practice:

None — this is the default code path for every inbound message

Detection/coverage: Forensic hunting via grep -i "COPY.*TO PROGRAM" mail_logs on the appliance, but root-level attackers can tamper with local logs.

STEP 04

Escalate from SQL to root OS command execution

The attacker chains the SQL injection into operating system command execution using PostgreSQL's COPY ... TO PROGRAM function, which allows arbitrary command execution from within a SQL statement. The PostgreSQL process runs with root privileges on AsyncOS, so commands execute as root immediately — no local privilege escalation step required.

Conditions required:

PostgreSQL COPY TO PROGRAM is available (default in AsyncOS's bundled PostgreSQL)

Where this breaks in practice:

None — this is a well-documented, deterministic PostgreSQL RCE primitive that works on first attempt

Detection/coverage: Process execution monitoring (if deployed on the appliance); anomalous child processes spawned by PostgreSQL service.

STEP 05

Achieve persistent access and pivot

With root on the email gateway, the attacker can read, modify, and intercept all email traffic in transit; exfiltrate sensitive communications; deploy persistent backdoors (SSH keys, cron jobs, modified binaries); harvest credentials from emails (MFA codes, password resets); and pivot into the internal network from the gateway's DMZ position. The attacker can also wipe local logs to eliminate forensic evidence.

Conditions required:

Successful Step 4

Where this breaks in practice:

None

Detection/coverage: External log forwarding (syslog to SIEM) is the only reliable detection vector since local logs can be tampered with. Network-level anomaly detection for unusual outbound connections from the gateway IP ranges.

03 · Compensating Control

CRITICAL 9.8→IGNORE 0.0

SEVERITY REDUCED

Patch immediately to fixed AsyncOS release — Upgrade to 15.5.5-014, 16.0.4-302, or 16.5.0-780 (preferred). This is the only true remediation. Because this is KEV-listed with active exploitation, the noisgate mitigation SLA is overridden — deploy within hours, not the standard 3-day CRITICAL window. Schedule an emergency maintenance window; reboot is required post-upgrade. This eliminates the vulnerability entirely by fixing the SQL injection in the email parsing pipeline.

CRITICAL 9.8→CRITICAL 9.0

Forward all appliance logs to external SIEM immediately — Configure syslog forwarding from every Cisco SEG appliance to your SIEM (Splunk, Sentinel, Elastic) for mail_logs, system logs, and audit logs. Deploy within hours. Root-level attackers can and will tamper with local logs — external forwarding preserves forensic evidence and enables detection of exploitation attempts via COPY.*TO PROGRAM patterns. This does not prevent exploitation but enables detection and incident response.

CRITICAL 9.8→CRITICAL 9.8

Hunt for indicators of compromise on all gateways — Run grep -i 'COPY.*TO PROGRAM' mail_logs on every Cisco SEG appliance. Review firewall logs for anomalous outbound connections from gateway IPs. Check for unauthorized SSH keys, cron jobs, or new user accounts. Cross-reference with Cisco's IoC guidance. Execute immediately, before and after patching. This is purely reactive — it detects past compromise but does not prevent future exploitation.

CRITICAL 9.8→CRITICAL 8.5

Implement network-level anomaly detection on gateway egress — Monitor all outbound traffic from Cisco SEG appliance IPs for unusual destinations, protocols, or data volumes. Alert on any outbound connections not destined for known mail servers or Cisco update endpoints. Deploy within the noisgate CRITICAL mitigation SLA of 3 days. This catches post-exploitation data exfiltration and C2 but does not prevent the initial compromise.

CRITICAL 9.8→CRITICAL 9.0

Enforce file integrity monitoring on the appliance — Deploy or enable FIM to detect unauthorized changes to system files, binaries, and configuration on each SEG appliance. This provides a tripwire for persistent backdoors installed post-exploitation. Deploy within the noisgate CRITICAL mitigation SLA of 3 days. Detection-only — does not prevent initial exploitation or privilege escalation.

What doesn't work

Management interface ACLs — The attack is delivered via SMTP through the mail processing pipeline, not through the management interface. Restricting management access has zero effect on this vulnerability.
WAF / IPS in front of the gateway — The attack payload is embedded in email headers/body processed by the SMTP pipeline. Standard WAF rules inspect HTTP traffic, not SMTP email content. Even SMTP-aware IPS would need specific signatures for this SQLi pattern, which were not available at disclosure.
Disabling specific AsyncOS features — Cisco confirmed no workaround or feature toggle mitigates this vulnerability. The vulnerable code path is in core email parsing, which cannot be disabled without disabling the appliance's primary function.
Upstream email filtering (e.g., another email gateway in front) — While theoretically an upstream filter could strip malicious headers, the specific injection point and payload format are not publicly documented in enough detail for generic email filters to reliably detect. You would be asking one email security product to protect another from an undisclosed attack pattern.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	Actively exploited as a zero-day. Cisco PSIRT confirmed exploitation prior to the September 14, 2026 disclosure. CISA added to KEV same day with a September 17 remediation deadline. No public threat actor attribution.
Proof-of-concept	No public PoC at time of assessment. No repositories named CVE-2026-76461 found on GitHub. Not indexed on pocindex.io, ExploitDB, or Metasploit as of 2026-10-09. However, the advisory details and PostgreSQL `COPY TO PROGRAM` technique provide sufficient information for a skilled attacker to reconstruct an exploit independently.
EPSS	0.28269 (28.3%) — extremely high, reflecting active exploitation. Likely above the 95th percentile of all scored CVEs.
KEV status	Listed 2026-09-14. Remediation deadline: 2026-09-17 (3 days). One of the shortest KEV deadlines issued, reflecting confirmed zero-day exploitation severity.
CVSS vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Network-reachable, low complexity, no privileges, no user interaction. Every base metric is worst-case except Scope (Unchanged — a CVSS modeling artifact; practical impact is cross-boundary).
Affected versions	AsyncOS 15.5 and all earlier, 16.0.x, 16.5.x. Physical appliances, virtual instances, and on-premises deployments. Cisco Secure Email Cloud tenants remediated server-side by Cisco.
Fixed versions	15.5.5-014, 16.0.4-302, 16.5.0-780 (preferred; includes additional hardening fixes from a companion advisory).
Internet exposure	Shadowserver tracked 400+ internet-exposed Cisco Secure Email Gateway appliances at disclosure. Actual attackable population is far larger — any gateway reachable via MX record is exploitable without direct IP exposure to scanning.
Disclosure date	2026-09-14. Cisco disclosed after PSIRT became aware of active exploitation. Zero-day exploitation likely began weeks or months earlier (one source references September 2025 awareness).
Reporting researcher	Not attributed. Discovered through Cisco PSIRT's awareness of in-the-wild exploitation. No external researcher credited.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

Why this verdict

Zero friction in the entire attack chain. Every step from crafted email to root shell requires zero authentication, zero user interaction, zero special configuration, and zero internal network access. The attack surface — SMTP email processing — is exposed by design on every deployment. Starting from the vendor baseline of 9.8, no downward adjustments are warranted.
Active zero-day exploitation with KEV listing. This was exploited in the wild before Cisco disclosed it. CISA's 3-day remediation deadline (the shortest category) reflects the operational urgency. Active exploitation overrides any theoretical friction analysis and eliminates the possibility of a downgrade.
No workaround exists. Unlike many network appliance CVEs, there is no configuration change, ACL, or feature toggle that mitigates this vulnerability. The only remediation is patching. This eliminates the usual compensating-control safety net that might otherwise soften a CRITICAL rating.
Role multiplier: Cisco Secure Email Gateway is a canonical network-edge appliance — 100% of deployments occupy the high-value role by definition. Compromise yields: email surveillance and data exfiltration (organizational-scale blast radius), credential harvesting from email traffic (MFA codes, password resets, approval workflows), persistent backdoor in the DMZ with pivot potential to internal networks, and ability to tamper with email-borne security controls. The blast radius is organizational-scale to supply-chain-scale. Per the deployment-role floor rule, a canonical high-value-role component with a successful unauthenticated chain floors the verdict at CRITICAL.
PostgreSQL RCE primitive is deterministic. The COPY ... TO PROGRAM technique is a well-understood, reliable escalation from SQL injection to OS command execution. This is not a race condition or heap spray — it works on first attempt with no probabilistic failure modes.

Why not higher?

9.8 is effectively the ceiling for this CVSS vector. The only non-worst-case element is Scope:Unchanged (S:U), which is a CVSS modeling artifact — in practice, root on an email gateway provides cross-boundary impact across the entire organization's email flow and DMZ network segment. A 10.0 would require Scope:Changed in the CVSS model, but the real-world severity is already at maximum practical impact.

Why not lower?

Every friction checkpoint favors the attacker. The attack is unauthenticated and remote, requires no user interaction, targets a universally internet-exposed service (SMTP), has confirmed zero-day exploitation, has no workaround, and compromises a canonical high-value network-edge appliance whose sole purpose is processing untrusted input. There is no defensible basis for any downgrade — no prerequisite narrows the reachable population, no modern security tool reliably intercepts this attack vector, and no configuration hardens against it.

06 · Verification

Crowdsourced verification payload.

Run from an auditor workstation with SSH access to each Cisco Secure Email Gateway appliance. Usage: bash check_cve_2026_76461.sh <hostname_or_ip>. Requires SSH key-based or password authentication to the appliance CLI. No elevated privileges beyond standard admin CLI access needed.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_76461.sh — Verify Cisco Secure Email Gateway patch status
# CVE-2026-76461: AsyncOS SQLi-to-Root RCE in email parsing
# Usage: bash check_cve_2026_76461.sh <hostname_or_ip>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <hostname_or_ip>"
  exit 2
fi

HOST="$1"

# Grab AsyncOS version via SSH CLI
VERSION_OUTPUT=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$HOST" "version" 2>/dev/null) || {
  echo "UNKNOWN — cannot connect to $HOST via SSH"
  exit 2
}

# Extract the AsyncOS version string (e.g., 16.0.4-302)
ASYNCOS_VER=$(echo "$VERSION_OUTPUT" | grep -oP 'AsyncOS\s+\K[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' | head -1)

if [[ -z "$ASYNCOS_VER" ]]; then
  echo "UNKNOWN — could not parse AsyncOS version from $HOST"
  echo "Raw output: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected AsyncOS version: $ASYNCOS_VER on $HOST"

# Parse major.minor.patch-build
IFS='.-' read -r MAJOR MINOR PATCH BUILD <<< "$ASYNCOS_VER"

# Fixed versions:
#   15.5.5-014 (branch 15.5.x and earlier)
#   16.0.4-302 (branch 16.0.x)
#   16.5.0-780 (branch 16.5.x)

check_patched() {
  local maj=$1 min=$2 pat=$3 bld=$4
  if (( maj < 15 )); then
    return 1  # All pre-15.5 are vulnerable
  elif (( maj == 15 && min <= 5 )); then
    # Fixed at 15.5.5-014
    if (( min < 5 )); then return 1; fi
    if (( pat < 5 )); then return 1; fi
    if (( pat == 5 && bld < 14 )); then return 1; fi
    return 0
  elif (( maj == 16 && min == 0 )); then
    # Fixed at 16.0.4-302
    if (( pat < 4 )); then return 1; fi
    if (( pat == 4 && bld < 302 )); then return 1; fi
    return 0
  elif (( maj == 16 && min == 5 )); then
    # Fixed at 16.5.0-780
    if (( pat < 0 )); then return 1; fi
    if (( pat == 0 && bld < 780 )); then return 1; fi
    return 0
  elif (( maj > 16 )); then
    return 0  # Future versions assumed patched
  fi
  return 1  # Default to vulnerable
}

if check_patched "$MAJOR" "$MINOR" "$PATCH" "$BUILD"; then
  echo "PATCHED — $HOST is running AsyncOS $ASYNCOS_VER (fixed)"
  exit 0
else
  echo "VULNERABLE — $HOST is running AsyncOS $ASYNCOS_VER (CVE-2026-76461)"
  echo "Upgrade to: 15.5.5-014, 16.0.4-302, or 16.5.0-780"
  exit 1
fi