A crafted email can compromise Cisco Secure Email Gateway
An SQL injection in Cisco AsyncOS lets an unauthenticated remote attacker run commands as root by sending a crafted email; it is being exploited.
What happened
Vulnerability CVE-2026-76461 has a CVSS score of 9.8 and affects Cisco AsyncOS. An unauthenticated remote attacker sends an email with malicious SQL statements and manages to execute commands as root. It affects physical and virtual appliances whatever their configuration, it is actively exploited and there are no workarounds. Cisco has published the fixed versions: 15.5.5-014 for the 15.5 and earlier branch, 16.0.4-302 for 16.0 and 16.5.0-780 for 16.5.
Why it matters
The entry point is email, the channel an organisation cannot close. And the flaw is exploited before the message reaches the inbox, so it does not depend on anyone clicking a link or on the user making a mistake: the device only has to receive the message. That there are no workarounds leaves a single way out, and that execution is as root means the attacker does not need to escalate afterwards. That the device is a mail gateway also means it usually sits outside the corporate perimeter.
What we recommend
Update to the fixed version in the Cisco advisory and review the email logs of every device in the cluster for SQL statements. With no alternative mitigation, updating is the only measure that closes the flaw, and it must reach every node in the cluster, not just the one that is usually administered.
Related service: ciberseguridad · respuesta-incidentes
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.