A single email, root access
Cisco has confirmed that attackers are actively exploiting a critical flaw in its Secure Email Gateway appliances, and there is no workaround. The only fix is to patch, and the US Cybersecurity and Infrastructure Security Agency (CISA) has given federal civilian agencies until September 17, 2026, to do it.
The flaw is tracked as CVE-2026-76461 and carries a Common Vulnerability Scoring System (CVSS) score of 9.8 out of 10, near the top of the 0-to-10 scale that security teams use to rank how severe and how easy to exploit a bug is. It sits in how Cisco's AsyncOS software parses incoming email. An attacker does not need an account, a session, or any interaction from a victim. They just need to send an email to an address the gateway handles, which makes this the kind of bug that can be scanned for and hit automatically at scale rather than requiring a targeted, hands-on-keyboard intrusion.
How the attack works
Secure Email Gateway appliances scan and process every message that passes through them, which normally means checking for spam and malware. CVE-2026-76461 exists because the parsing logic does not properly validate message content before that content reaches a database query. An attacker can embed Structured Query Language (SQL) statements inside a crafted email, and the appliance will execute them.
From there, the SQL injection escalates into full remote code execution (RCE) on the underlying operating system, with root privileges. Root is the highest level of access a Linux-based system grants, and Cisco has pointed out the specific danger of that level of access here: an attacker who reaches root can also erase the logs and traces that would normally reveal the intrusion, making cleanup and forensic investigation much harder after the fact.
Who is exposed
The bug affects Cisco AsyncOS for Secure Email Gateway in version 15.5 and earlier, version 16.0, and version 16.5. Cisco says both physical appliances and virtual deployments are vulnerable, and the flaw does not depend on any particular feature being turned on or off, so simply running the software is enough to be exposed. Two related products, Secure Email and Web Manager and Secure Web Appliance, are not affected.
Fixed versions are available: 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with Cisco pointing customers toward 16.5.0-780 as the version to migrate to. Cisco's advisory states plainly that there are no workarounds, which means disabling a feature or tightening a configuration will not protect an unpatched device. Patching is the only option.
What Cisco has said about the attacks
Cisco's Product Security Incident Response Team (PSIRT) says it became aware of active exploitation of this vulnerability in September 2026. The company has not disclosed who is behind the attacks, how many organizations have been hit, or how the campaign was first spotted. It has said only that exploitation is happening now.
Because Secure Email Gateway appliances sit at the network perimeter and touch every inbound message before a human ever sees it, a compromised one gives an attacker a foothold with visibility into internal mail flow and a launching point for lateral movement into whatever network the appliance protects. Mail appliances are also often exempted from the endpoint monitoring that runs on ordinary servers, since they are treated as fixed-function security tools rather than general-purpose hosts, which can leave a compromise unnoticed for longer than it would be elsewhere on the network. That combination, pre-authentication access plus root privileges on an internet-facing mail appliance, is why the CVSS score sits at the top of the scale and why CISA moved quickly to add it to its Known Exploited Vulnerabilities (KEV) catalog.
What this means in practice
Any organization running a Secure Email Gateway appliance, physical or virtual, should treat this as urgent regardless of whether it is a federal agency bound by the CISA deadline. The absence of a workaround removes the usual option of buying time with a configuration change, so the patch itself is the only mitigation. Security teams that cannot patch immediately should scan mail logs for SQL-like fragments, such as unexpected COPY-style statements, sitting inside message content, as a rough indicator of attempted exploitation. Because a successful attack grants root, teams should also assume that any appliance already compromised may have had its own logs tampered with to erase that evidence, which means a clean-looking log cannot be treated as proof the device was never hit.
