Cisco warned on Monday, Sept. 15, that attackers are exploiting a zero-day in its Secure Email Gateway appliances. The flaw gives them root-level control of the device through a single crafted email. The vulnerability, CVE-2026-76461, has a CVSS score of 9.8. It requires no authentication and no user interaction, SecurityWeek reported.
One email, root access
The flaw is in the email parsing logic of AsyncOS, Cisco’s operating system for the gateways. Insufficient validation lets an attacker send a message containing malicious SQL statements through an affected device. “A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system,” Cisco said, according to Help Net Security.
The bug affects physical and virtual Secure Email Gateway appliances in any configuration running AsyncOS 16.5, 16.0, and 15.5 and earlier. Secure Email and Web Manager and Secure Web Appliance aren’t affected. The cloud-delivered Cisco Secure Email Cloud was hit too. Cisco said it “has directly contacted customers who own Cisco Secure Email Cloud devices” where it found signs of compromise, and it has upgraded all cloud devices to release 16.5.0-780.
Cisco hasn’t said who is behind the attacks or how many organizations were hit, though it indicated multiple customers were likely compromised before disclosure, CyberScoop reported. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Sept. 17 to fix it. It’s only the second Secure Email Gateway bug on the KEV list, after CVE-2025-20393, which China-linked attackers began exploiting in late 2025.
“Pretty ugly”
“In practical terms, that gives the attacker control of the gateway itself,” said Douglas McKee, director of vulnerability intelligence at Rapid7. “The combination here is pretty ugly. No authentication is required, an attacker can reach the vulnerable code by sending an email through the appliance, successful exploitation can result in root-level command execution, and Cisco has observed exploitation in the wild.”
Spencer McIntyre, director of exploit development at VulnCheck, said an attacker could keep access and quietly monitor email. “It’s going to be worse for organizations that have the appliance deployed on-premises. In this case, the attacker could pivot internally,” he said.
What to do
Upgrade to a fixed release: 15.5.5-014, 16.0.4-302 or, preferably, 16.5.0-780. The 15.5.5-014 and 16.5.0-780 releases also fix several other critical flaws Cisco found internally. Check the devices’ mail_logs, and every device in a cluster, for suspicious SQL statements. Root access lets attackers delete or hide evidence, so Cisco also recommends cross-checking network and firewall logs outside the appliance. Look for unexpected uploads from the gateway to external IPs or downloads from malicious addresses. If indicators of compromise turn up, contact Cisco TAC.
WebProNews is an iEntry Publication