Cisco Warns of Actively Exploited SQL Injection Zero Day in Secure Email Gateway as CISA Sets Deadline

Cisco Systems has disclosed a critical SQL injection vulnerability in its Secure Email Gateway product that is already being exploited in the wild, allowing an unauthenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. The flaw is tracked as CVE-2026-76461 and affects AsyncOS software for both physical and virtual Secure Email Gateway appliances regardless of device configuration. Cisco's Product Security Incident Response Team, or PSIRT, published advisory cisco-sa-esa-inj-2bLVGmhX on September 14, 2026 at 16:00 GMT, rating the issue Critical with a CVSS 3.1 base score of 9.8. Cisco said it became aware of active exploitation in September 2026 and released fixed software with no workarounds.

The vulnerability is a SQL injection, classified as CWE-89, that stems from insufficient validation in the email parsing logic. According to Cisco, an attacker can exploit it by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit can allow the attacker to execute arbitrary SQL statements, which then leads to command execution with root privileges on the underlying operating system. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the attack is network reachable, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability. In practical terms, the email gateway becomes a direct path to full control of the appliance.

The disclosure has immediate federal consequences. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14, 2026, the same day Cisco published its advisory. Under Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, federal civilian executive branch agencies must apply patches by September 17, 2026. That leaves roughly three calendar days from disclosure to remediation for a flaw that Cisco says has no workaround other than updating AsyncOS.

Key Facts

Cisco said on September 14 in its advisory that CVE-2026-76461 affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration. Secure Email and Web Manager and Secure Web Appliance are confirmed not vulnerable. The advisory describes a flaw in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges. Cisco assigned a Critical severity rating and a CVSS base score of 9.8. There are no workarounds, so affected organizations must upgrade to a fixed release.

Fixed releases cover three AsyncOS trains. Customers on 15.5 and earlier should upgrade to 15.5.5-0141. Customers on 16.0 should upgrade to 16.0.4-3021. Customers on 16.5 should upgrade to 16.5.0-780, which Cisco strongly recommends as the migration target. Cisco also said it has already upgraded all Cisco Secure Email Cloud devices to 16.5.0-780. For suspected compromise on physical appliances, Cisco recommends contacting Cisco Technical Assistance Center, or TAC. For virtual appliances, it recommends preserving forensics, deploying a new virtual machine on a fixed release, rebuilding the configuration, and renewing credentials and cryptographic material.

Cisco published indicators of compromise and triage steps. Administrators should review mail_logs for suspicious SQL statements and check each cluster device. The advisory includes a command to run against the IronPort Text Mail Logs: grep -i "COPY.*TO PROGRAM". Any output may indicate malicious activity. Cisco cautioned that because attackers can reach root, they may delete or hide evidence, so defenders should cross check network and firewall logs outside the appliance for unexpected uploads to external IP addresses or downloads from malicious IP addresses.

CISA said on September 14 that it added the vulnerability based on evidence of active exploitation. The agency noted that BOD 26-04 establishes vulnerability management requirements for Federal Civilian Executive Branch agencies, reinforces the importance of the KEV Catalog, and requires agencies to prioritize rapid remediation of high risk vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation. BOD 26-04 also sets expectations for when agencies must check whether threat actors compromised a system before the patch was applied. CISA encourages all organizations to adopt risk based vulnerability management and prioritize remediation of KEV catalog vulnerabilities.

Analysis

What this really means is that enterprise email remains a high value target for attackers who want root level access without needing credentials. Cisco Secure Email Gateway sits directly in the path of inbound mail, so a crafted message can arrive from the public internet with no prior access. The vulnerability turns that message into a command execution primitive. Because the flaw is a SQL injection in email parsing, it also highlights how parsing code that handles untrusted input can become a system level compromise when it runs on an appliance that holds sensitive mail flow and credentials. The CVSS score of 9.8 reflects that combination of remote reach, no authentication, no user interaction, and high impact across confidentiality, integrity and availability.

The bigger picture here is that edge appliances remain a weak link in many networks, and attackers know it. Cisco's timeline shows that exploitation was already underway by the time the advisory appeared. SecurityWeek reported on September 15 that Cisco warned customers on Monday, September 14, 2026, and that the PSIRT became aware of exploitation in September 2026 but shared no details on the attacks or who is behind them. For agencies covered by BOD 26-04, the requirement is not just to patch but also to check for pre patch compromise. That check matters because root level attackers can remove logs and hide their activity, which is why Cisco tells defenders to look at network and firewall logs outside the appliance.

The explicit judgement from this disclosure is that organizations should treat CVE-2026-76461 as an emergency, not a routine patch. Cisco offered no workarounds, which removes the usual temporary mitigations such as disabling a feature or adding a rule. The only complete fix is an AsyncOS upgrade to 15.5.5-0141, 16.0.4-3021, or 16.5.0-780. The fact that Cisco already upgraded all Secure Email Cloud devices to 16.5.0-780 shows how seriously the company views the issue for its own hosted service. On premises customers do not have that automatic path. They must plan the upgrade, verify the version, and then investigate for signs of compromise. If they find evidence, Cisco's guidance for physical appliances points to Cisco TAC, while virtual appliance owners should preserve forensics and rebuild on a fixed release with new credentials and cryptographic material.

Why It Matters

The immediate operational impact is severe for any organization running an affected Secure Email Gateway. An unauthenticated remote attacker who successfully exploits CVE-2026-76461 can execute arbitrary commands with root privileges on the underlying operating system. Root access on an email gateway can expose mail content, credentials, configuration data, and trust relationships with other systems. Attackers with root can also delete or hide evidence, which complicates incident response and can leave an organization unsure whether it was compromised before patching. Cisco's IoC guidance focuses on mail_logs and the grep command for COPY TO PROGRAM patterns, but the company also warns that evidence may be incomplete because of attacker cleanup. That is why external network and firewall logs are part of the recommended triage. The Hacker News reported on September 15 that CVE-2026-76461 is only the second Cisco Secure Email Gateway flaw in the KEV catalog, after CVE-2025-20393, which China linked threat actors began exploiting in late 2025.

For U.S. federal agencies, the matter is also a compliance deadline. CISA added CVE-2026-76461 to the KEV catalog on September 14, 2026, and BOD 26-04 requires remediation by September 17, 2026. The directive applies to Federal Civilian Executive Branch agencies, but CISA encourages all organizations to adopt risk based vulnerability management. The KEV listing also carries an expectation around checking for compromise before the patch was applied, because the vulnerability grants total control of the asset after exploitation. That combination of a short deadline, a critical severity rating, and evidence of active exploitation makes this one of the more urgent patch events of September 2026. The fact that there are no workarounds means that delays cannot be offset by temporary controls.

Next Up

The next steps for administrators are straightforward but time sensitive. Identify every Secure Email Gateway appliance, confirm the AsyncOS version, and upgrade to the fixed release for the appropriate train: 15.5.5-0141 for 15.5 and earlier, 16.0.4-3021 for 16.0, or 16.5.0-780 for 16.5. Review mail_logs on each cluster device and run grep -i "COPY.*TO PROGRAM" against the IronPort Text Mail Logs. Cross check network and firewall logs for unexpected uploads to external IP addresses or downloads from malicious IP addresses. If a physical appliance is suspected of compromise, contact Cisco TAC. If a virtual appliance is affected, preserve forensics, deploy a new virtual machine on a fixed release, rebuild the configuration, and renew credentials and cryptographic material.