CISA has added an actively exploited Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog and given federal agencies until September 17 to remediate and perform forensic triage. Cisco says a crafted email can reach the vulnerable parser without authentication or user interaction and lead to command execution with root privileges on the appliance.
What changed
Cisco disclosed CVE-2026-76461 on September 14 after its product-security team became aware of active exploitation. The SQL-injection flaw sits in the email-parsing logic of AsyncOS for Secure Email Gateway. Cisco rates it critical at CVSS 9.8 and says both physical and virtual gateways are affected regardless of device configuration.
The first fixed releases are 15.5.5-014 for the 15.5-and-earlier branch, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5; Cisco strongly recommends moving to 16.5.0-780. There is no workaround. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected by this specific CVE, while its managed Secure Email Cloud devices have already been upgraded.
CISA added the flaw to its catalog at 19:00 UTC on September 14, three hours after Cisco published the advisory. The catalog marks forensic triage as required, lists ransomware use as unknown, and applies a September 17 deadline under the agency’s risk-based remediation directive.
The practical consequence
This is a patch-and-investigate event, not a routine version update. Because ordinary inbound mail can carry the malicious input and successful exploitation gives an attacker root access, an affected gateway can no longer be treated as a trustworthy source of its own evidence. Cisco warns that an attacker at that privilege level may remove or hide indicators.
Administrators should preserve evidence before rebuilding anything, review mail_logs on every cluster member for suspicious SQL, and cross-check external firewall and network logs for unexpected transfers. If a virtual appliance may be compromised, Cisco recommends preserving forensic material, deploying a fresh virtual machine on fixed software, rebuilding the configuration, and renewing credentials and cryptographic material. Suspected compromise of a physical appliance should be escalated to Cisco TAC.
Limits and evidence
Cisco and CISA confirm exploitation, but neither public notice identifies the attacker, targets, victim count, campaign duration, delivery volume, or whether a particular observed incident achieved root command execution. Ransomware use is unknown. The published log pattern is explicitly non-exhaustive, and clean local logs do not exclude compromise because root access can permit evidence removal.
CVSS is a severity assessment, not a measure of exploitation prevalence. No benchmark applies, and DrComps did not reproduce the vulnerability or attacks. Affected-version, recovery, and managed-cloud remediation statements come from Cisco; operators should verify their precise release and deployment state against the current advisory.