CVE-2026-76461
Description
CVE-2026-76461 is a critical RCE vulnerability in Cisco Secure Email Gateway (CVSS 9.8) being actively exploited via crafted email messages.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| asyncos | * | 15.5.5-014 | vulnerable |
| asyncos | 16.0 | 16.0.4-302 | vulnerable |
| asyncos | 16.5 | 16.5.0-780 | vulnerable |
| secure_email_gateway_virtual_appliance_c100v | - | - | unaffected |
| secure_email_gateway_virtual_appliance_c300v | - | - | unaffected |
| secure_email_gateway_virtual_appliance_c600v | - | - | unaffected |
| secure_email_gateway_c195 | - | - | unaffected |
| secure_email_gateway_c395 | - | - | unaffected |
| secure_email_gateway_c695 | - | - | unaffected |
Related weakness (CWE)
Remediation plan
Apply official patches
Cisco has released security updates for Cisco AsyncOS Software to address this critical SQL injection vulnerability. Organizations should refer to the Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX for detailed instructions on obtaining and installing the necessary software fixes for their hardware or virtual appliances.
Update affected systems
Update Cisco Secure Email Gateway to AsyncOS versions 15.5.5-014, 16.0.4-302, 16.5.0-780, or later. Systems running versions prior to these releases are vulnerable and should be upgraded immediately to mitigate the risk of remote command execution and system takeover.
Restrict access
Since the vulnerability is exploited via crafted email messages, ensure that only trusted mail servers can relay traffic to the gateway where possible. Additionally, harden the appliance by restricting administrative access (SSH/HTTPS) to internal management networks and implementing multi-factor authentication for all users.
Monitor for exploitation
Monitor system and mail logs for evidence of SQL injection attempts or unusual system commands. In accordance with CISA's BOD 26-04, perform forensics triage to identify potential indicators of compromise, such as unauthorized root-level process execution or unexpected outbound network traffic originating from the gateway.
Detection Guidance
"Detecting exploitation involves monitoring SMTP traffic for SQL injection patterns, such as 'UNION SELECT' or unexpected semicolons within email headers and bodies. Security teams should analyze Cisco AsyncOS logs for database syntax errors or evidence of shell command execution. Deploying network-based signatures (IDS/IPS) to inspect inbound mail for malicious payloads and auditing root-level system changes are critical for identifying active compromise."