Full Report
Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of insufficient validation in the email parsing logic that could allow an unauthenticated, remote attacker
Analysis Summary
# Vulnerability: Cisco Secure Email Gateway Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-76461
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Insufficient validation in email parsing logic (leads to SQL Injection and Command Injection)
## Affected Systems
- **Products:** Cisco Secure Email Gateway (formerly Email Security Appliance - ESA), both physical and virtual appliances.
- **Versions:**
- AsyncOS 15.5 and earlier
- AsyncOS 16.0
- AsyncOS 16.5
- **Configurations:** All device configurations are affected; the flaw is independent of specific feature sets.
## Vulnerability Description
The flaw exists in the email parsing logic of the Cisco AsyncOS Software. The system fails to properly validate input, allowing a remote attacker to inject malicious SQL statements into a crafted email message. Because these statements are executed by the underlying operating system, an attacker can pivot from SQL injection to executing arbitrary commands with **root privileges**.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV catalog).
- **Complexity:** Low
- **Attack Vector:** Network (Remote, unauthenticated)
## Impact
- **Confidentiality:** Total (Root access allows full data exfiltration)
- **Integrity:** Total (Attackers can modify system files and hide logs)
- **Availability:** Total (Full system control)
## Remediation
### Patches
Cisco has released the following fixed versions of AsyncOS:
- **15.5.5-0141** (for versions 15.5 and earlier)
- **16.0.4-302** (for version 16.0)
- **16.5.0-780** (for version 16.5)
### Workarounds
- **None:** There are no documented workarounds. Administrators must apply the software updates to mitigate the risk.
## Detection
- **Log Analysis:** Review `mail_logs` for suspicious SQL statements.
- **CLI Detection:** Run the following command on the appliance:
`cisco-esa> grep -i "COPY.*TO PROGRAM" [Log name]`
- **External Monitoring:** Because root-level attackers can delete local logs, administrators should inspect external firewall and network logs for:
- Unexpected outbound uploads to external IP addresses.
- Unexpected downloads from known malicious IP addresses.
## References
- **Vendor Advisory:** hxxps://sec.cloudapps.cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
- **CISA KEV Catalog:** hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Source Article:** hxxps://thehackernews[.]com/2026/09/cisco-secure-email-gateway-flaw.html