What happened
On September 14, 2026, Cisco published a security advisory for a critical flaw, CVE-2026-76461, in AsyncOS, the software that runs the Cisco Secure Email Gateway. This appliance sits in front of a company’s mail server and filters incoming and outgoing email for spam, malicious attachments and similar threats.
The bug lives in the part of the software that parses email messages. According to Cisco, an attacker can send a specially crafted email through the device and end up running arbitrary commands with the highest privileges (root) on the gateway’s operating system.
The US agency CISA added the flaw to its catalog of actively exploited vulnerabilities on the same day, September 14, 2026. The EU vulnerability database EUVD (entry EUVD-2026-77625) also lists it as exploited since September 14, 2026. Cisco has not said who is behind the attacks.
Cisco last updated the advisory on November 3, 2026. It says that on October 31, 2026 it released an updated version of the fix contained in release 15.5.5-014, in light of new information about exploit code available online.
Why it is dangerous
This is an SQL injection vulnerability (CWE-89). Picture a clerk who copies form entries straight into a database without reading them. If someone writes a database command into the “name” field instead of a name, the clerk simply runs it. According to Cisco, the gateway does not properly check the content of the emails it parses, so an attacker can smuggle their own commands into its database and from there into the operating system.
The attacker does not need to log in, and nobody at your company has to click anything. The email only has to pass through the gateway, which is exactly what the gateway is for. The attack works over the internet, and anyone who can send you mail can attempt it.
A successful attack grants root privileges, meaning full control of the gateway. Cisco warns that with this level of access an attacker can remove or hide evidence of the attack. In a cluster, according to Cisco, the attacker could also obtain the private SSH keys that members use to authenticate to each other and use them to compromise the other gateways.
- CVSS 9.8 out of 10: the severity rating assigned by Cisco itself under CVSS 3.1. It is close to the maximum because the attack is remote, simple and needs no login.
- CISA KEV: the catalog of flaws that the US agency CISA knows are being exploited in the wild. US federal agencies had to fix this one by September 17, 2026. CISA has not stated whether ransomware groups are using it.
- EPSS 29.5% (as of November 3, 2026): an estimate of the likelihood of exploitation in the next 30 days. This places the flaw among roughly the top 2% riskiest of all tracked vulnerabilities.
Who is affected
The flaw affects Cisco Secure Email Gateway appliances (also known as Cisco ESA or IronPort), both physical and virtual, and according to Cisco regardless of configuration. The following AsyncOS release trains are vulnerable unless the fix is installed:
- 15.5 and earlier (fixed in 15.5.5-014)
- 16.0 (fixed in 16.0.4-302)
- 16.5 (fixed in 16.5.0-780)
These are typically email gateways at mid-sized and larger companies, public sector bodies or IT service providers, filtering mail in front of Exchange or Microsoft 365. By design such a device is reachable from the internet, otherwise it could not receive mail.
Cisco has confirmed that Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco has already upgraded all Cisco Secure Email Cloud devices to release 16.5.0-780.
How to check if you are affected
You can find the version in the gateway’s web interface, for example under System Administration > System Upgrade, which shows the currently installed release. On the device command line (CLI), the read-only version command displays it:
versionIf you are on 15.5.5-014, also confirm that the updated fix from October 31, 2026 is installed. Cisco says to use the retroscannerstatus command and check that Cisco Retro Remediation Engine is at version 4.0.2 or later:
retroscannerstatusAccording to Cisco, release 16.5.0-780 is protected regardless of the Retro Remediation Engine version. If you run several gateways in a cluster, check each one separately.
How to fix it
Cisco has released fixed versions: 15.5.5-014 for 15.5 and earlier, 16.0.4-302 for the 16.0 train and 16.5.0-780 for the 16.5 train. If you are on anything older than 16.5, Cisco strongly recommends moving straight to 16.5.0-780. Cisco says there is no workaround, so upgrading is the only protection.
Recommended order of steps:
- Check the version on every gateway, including all cluster members.
- Before upgrading, review the logs as described in the compromise section. If you find anything suspicious, do not upgrade blindly and follow that section instead.
- If nothing looks suspicious, upgrade as soon as possible, ideally to 16.5.0-780.
- On 15.5.5-014, use
retroscannerstatusto confirm that Retro Remediation Engine is at 4.0.2 or later.
Upgrading through the web interface, per Cisco:
- Go to
System Administration > System Upgrade. - Click
Upgrade Options, thenDownload and Install. - Choose the target release and select the appropriate options under
Upgrade Preparation. - Click
Proceed. The device reboots when the upgrade finishes.
On the command line, run upgrade, enter DOWNLOADINSTALL, pick the release and follow the prompts. Expect a reboot and a short interruption in mail delivery, so schedule a suitable window. Cisco has already upgraded all Cisco Secure Email Cloud devices to 16.5.0-780.
What if you may already be compromised
Cisco recommends searching mail_logs for suspicious SQL statements, on every device if you run a cluster. As a non-exhaustive example, it gives this read-only search command for the gateway CLI. If you have renamed the log, use its name instead. Any matching entry may indicate malicious activity:
grep -i "COPY.*TO PROGRAM" mail_logsAn attacker with root access can erase traces on the device itself. Cisco therefore advises checking network and firewall logs outside the gateway, especially for unexpected uploads from the gateway to external IP addresses and downloads from malicious IP addresses.
On Cisco Secure Email Cloud, administrators without CLI access may not be able to check these indicators themselves. Cisco has directly contacted customers whose devices showed malicious activity.
If you suspect a physical appliance was compromised, contact Cisco TAC and enable remote access on the device. For virtual appliances, Cisco recommends first recording forensic data, because deploying a new instance destroys the configuration and logs. Then deploy a new virtual machine on a fixed release, rebuild the configuration, replace all credentials and cryptographic material (certificates, keys) and keep monitoring the system. If even one gateway in a cluster was compromised, restore every member. Without an in-house security team, bring in an incident response specialist before touching the device.