A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could

CVE-2026-76461 is an SQL injection in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway. When the appliance processes an inbound email, attacker-controlled SQL statements embedded in the message are executed against the appliance's internal PostgreSQL database. The COPY … TO PROGRAM primitive then converts that SQL execution into root-level OS command execution — no authentication, no user interaction, no special network position required. Affected versions span AsyncOS 13.0.0 through 16.0.4 across Cisco Secure Email Gateway, Secure Email Cloud, and Secure Email and Web Manager. Fixed releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780.

Cisco's CRITICAL / 9.8 rating is entirely justified and arguably understated for a real-world risk assessment. The vendor score captures the technical severity, but it cannot convey the operational reality: this is a device whose *sole purpose* is to receive untrusted email from the internet. There is no firewall rule you can write to block the attack vector without breaking the product. Cisco confirmed active exploitation on the same day as disclosure, CISA immediately added it to the KEV catalog, and Cisco explicitly states no workaround exists. Every unpatched appliance is a sitting target, processing attacker payloads as part of normal mail flow.

Why this verdict

• Zero-friction attack path: The attack requires only the ability to send an email to any address handled by the target gateway. No authentication, no user interaction, no special network position. This is the lowest possible bar for exploitation.
• Role multiplier: Cisco Secure Email Gateway is *by definition* a network edge appliance — 100% of installations occupy the high-value role. Root compromise yields: interception of all organizational email, credential harvesting (LDAP bind creds, SMTP AUTH), DMZ pivot to internal networks, and persistent surveillance. Blast radius is organization-wide (all email + lateral movement). The verdict floor is CRITICAL.
• Active exploitation with no workaround: Cisco confirmed in-the-wild exploitation, CISA listed in KEV within hours, and the vendor explicitly states no workaround or mitigation exists short of patching. Defenders cannot buy time with compensating controls — the only action is to patch.
• Massive affected version range: 21+ AsyncOS releases spanning 13.0.0 through 16.0.4 are vulnerable, covering effectively the entire installed base of currently supported and recently EOL versions.

Why not higher?

A 9.8 is already near the ceiling. The only element preventing a perfect 10.0 is the Scope metric being Unchanged (S:U) rather than Changed (S:C) in the CVSS vector — the formal scoring does not account for the *operational* blast radius of owning an email gateway, but in practice the impact extends far beyond the appliance itself. There is no reasonable basis to score this higher within the CVSS framework.

Why not lower?

Every downgrade factor is absent: the attack requires no authentication, no user interaction, no local access, no prior foothold, and no complex conditions. The target component is inherently internet-facing and cannot be shielded by firewall rules. Active exploitation is confirmed. No workaround exists. Downgrading this would require ignoring all available evidence.

1. Patch immediately to AsyncOS 16.5.0-780 — This is the only effective remediation. Cisco states no workaround exists. Under the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Schedule emergency maintenance windows tonight. Use the CLI upgrade command or web UI under System Administration → System Upgrade.
2. Monitor mail logs for COPY TO PROGRAM patterns — Run grep -i "COPY.*TO PROGRAM" across mail logs on all Cisco ESA/SEG appliances immediately to detect prior exploitation attempts. This is Cisco's recommended IoC. Do this *before* patching to understand if you've already been compromised.
3. Monitor outbound traffic from gateway IPs — Since root access allows log tampering, external network monitoring is more reliable than host-based detection. Alert on any outbound connections from your email gateway to unexpected destinations, especially on non-standard ports. Deploy within 3 days per the noisgate mitigation SLA.
4. Audit gateway for persistence artifacts — If IoCs are found, treat as a confirmed breach. Check for unauthorized SSH keys in /root/.ssh/, unexpected cron entries, modified system binaries (compare checksums against known-good images), and new user accounts. Root access means the attacker could have implanted anything.
5. Rotate credentials accessible from the gateway — If compromise is suspected, immediately rotate: LDAP bind credentials, SMTP relay credentials, management interface passwords, API keys, and any certificates stored on the appliance. The gateway legitimately stores these credentials and a root-level attacker has full access to them.

Run this script on each Cisco Secure Email Gateway appliance via SSH as an admin user (or via the CLI system shell if available). Example: ssh [email protected] then paste the script. Requires read access to AsyncOS version info and mail logs.

#!/bin/bash
# CVE-2026-76461 Verification Script
# Checks Cisco AsyncOS version and scans for exploitation IoCs
# Run on: Cisco Secure Email Gateway appliance via SSH
# Output: VULNERABLE / PATCHED / UNKNOWN + IoC scan results

set -euo pipefail

echo "=== CVE-2026-76461 Check ==="
echo "Date: $(date -u)"
echo ""

# Get AsyncOS version
VERSION=$(cat /data/release 2>/dev/null || echo "")
if [ -z "$VERSION" ]; then
  VERSION=$(grep -oP '[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' /etc/VERSION 2>/dev/null || echo "")
fi

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine AsyncOS version."
  echo "    Try running 'version' from the AsyncOS CLI instead."
  echo "UNKNOWN"
  exit 2
fi

echo "AsyncOS Version: $VERSION"
echo ""

# Extract major.minor.patch for comparison
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH_BUILD=$(echo "$VERSION" | cut -d. -f3)

# Fixed versions: 15.5.5-0141, 16.0.4-3021, 16.5.0-780
PATCHED=0

if [ "$MAJOR" -gt 16 ]; then
  PATCHED=1
elif [ "$MAJOR" -eq 16 ] && [ "$MINOR" -ge 5 ]; then
  # 16.5.0-780 or later
  PATCHED=1
elif [ "$MAJOR" -eq 16 ] && [ "$MINOR" -eq 0 ]; then
  # Check if >= 16.0.4-3021
  PATCH_NUM=$(echo "$PATCH_BUILD" | cut -d- -f1)
  BUILD_NUM=$(echo "$PATCH_BUILD" | cut -d- -f2)
  if [ "$PATCH_NUM" -gt 4 ] || ([ "$PATCH_NUM" -eq 4 ] && [ "$BUILD_NUM" -ge 3021 ]); then
    PATCHED=1
  fi
elif [ "$MAJOR" -eq 15 ] && [ "$MINOR" -eq 5 ]; then
  PATCH_NUM=$(echo "$PATCH_BUILD" | cut -d- -f1)
  BUILD_NUM=$(echo "$PATCH_BUILD" | cut -d- -f2)
  if [ "$PATCH_NUM" -gt 5 ] || ([ "$PATCH_NUM" -eq 5 ] && [ "$BUILD_NUM" -ge 141 ]); then
    PATCHED=1
  fi
fi

# Scan for IoCs regardless of patch status
echo "--- IoC Scan ---"
IOC_FOUND=0
LOG_DIRS="/data/log /data/pub/log /var/log"
for DIR in $LOG_DIRS; do
  if [ -d "$DIR" ]; then
    HITS=$(grep -ril "COPY.*TO PROGRAM" "$DIR" 2>/dev/null | head -20 || true)
    if [ -n "$HITS" ]; then
      echo "[!!!] EXPLOITATION IoC DETECTED in:"
      echo "$HITS"
      IOC_FOUND=1
    fi
  fi
done

if [ "$IOC_FOUND" -eq 0 ]; then
  echo "[OK] No COPY TO PROGRAM IoCs found in logs."
  echo "     Note: root-level attacker may have cleared logs."
fi
echo ""

# Verdict
if [ "$PATCHED" -eq 1 ]; then
  echo "PATCHED"
  exit 0
else
  echo "VULNERABLE"
  exit 1
fi

Sources

1. Cisco Security Advisory: cisco-sa-esa-inj-2bLVGmhX
2. CISA KEV Alert — September 14, 2026
3. Mallory.ai — Actively Exploited SQL Injection in Cisco Secure Email Gateway
4. OffSeq Threat Radar — CVE-2026-76461 Live Intelligence
5. Strix.ai — CVE-2026-76461 Analysis
6. Censys — Cisco ESA Exposure Data
7. Cisco Secure Email Gateway Security Advisories