# Cisco's Secure Email Gateway Has a Root RCE Under Active Attack Page: https://hirantha.me/blog/ciscos-secure-email-gateway-has-a-root-rce-under-active-attack Published: 2026-09-16 Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom Topics: cisco, secure email gateway, cve-2026-76461, cisa kev, remote code execution > A crafted email is enough to get root on Cisco's Secure Email Gateway, and CISA gives US agencies until September 17 to patch. ## A single email, root access Cisco has confirmed that attackers are actively exploiting a critical flaw in its Secure Email Gateway appliances, and there is no workaround. The only fix is to patch, and the US Cybersecurity and Infrastructure Security Agency (CISA) has given federal civilian agencies until September 17, 2026, to do it. The flaw is tracked as CVE-2026-76461 and carries a Common Vulnerability Scoring System (CVSS) score of 9.8 out of 10, near the top of the 0-to-10 scale that security teams use to rank how severe and how easy to exploit a bug is. It sits in how Cisco's AsyncOS software parses incoming email. An attacker does not need an account, a session, or any interaction from a victim. They just need to send an email to an address the gateway handles, which makes this the kind of bug that can be scanned for and hit automatically at scale rather than requiring a targeted, hands-on-keyboard intrusion. ## How the attack works Secure Email Gateway appliances scan and process every message that passes through them, which normally means checking for spam and malware. CVE-2026-76461 exists because the parsing logic does not properly validate message content before that content reaches a database query. An attacker can embed Structured Query Language (SQL) statements inside a crafted email, and the appliance will execute them. From there, the SQL injection escalates into full remote code execution (RCE) on the underlying operating system, with root privileges. Root is the highest level of access a Linux-based system grants, and Cisco has pointed out the specific danger of that level of access here: an attacker who reaches root can also erase the logs and traces that would normally reveal the intrusion, making cleanup and forensic investigation much harder after the fact. ## Who is exposed The bug affects Cisco AsyncOS for Secure Email Gateway in version 15.5 and earlier, version 16.0, and version 16.5. Cisco says both physical appliances and virtual deployments are vulnerable, and the flaw does not depend on any particular feature being turned on or off, so simply running the software is enough to be exposed. Two related products, Secure Email and Web Manager and Secure Web Appliance, are not affected. Fixed versions are available: 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with Cisco pointing customers toward 16.5.0-780 as the version to migrate to. Cisco's advisory states plainly that there are no workarounds, which means disabling a feature or tightening a configuration will not protect an unpatched device. Patching is the only option. ## What Cisco has said about the attacks Cisco's Product Security Incident Response Team (PSIRT) says it became aware of active exploitation of this vulnerability in September 2026. The company has not disclosed who is behind the attacks, how many organizations have been hit, or how the campaign was first spotted. It has said only that exploitation is happening now. Because Secure Email Gateway appliances sit at the network perimeter and touch every inbound message before a human ever sees it, a compromised one gives an attacker a foothold with visibility into internal mail flow and a launching point for lateral movement into whatever network the appliance protects. Mail appliances are also often exempted from the endpoint monitoring that runs on ordinary servers, since they are treated as fixed-function security tools rather than general-purpose hosts, which can leave a compromise unnoticed for longer than it would be elsewhere on the network. That combination, pre-authentication access plus root privileges on an internet-facing mail appliance, is why the CVSS score sits at the top of the scale and why CISA moved quickly to add it to its Known Exploited Vulnerabilities (KEV) catalog. ## What this means in practice Any organization running a Secure Email Gateway appliance, physical or virtual, should treat this as urgent regardless of whether it is a federal agency bound by the CISA deadline. The absence of a workaround removes the usual option of buying time with a configuration change, so the patch itself is the only mitigation. Security teams that cannot patch immediately should scan mail logs for SQL-like fragments, such as unexpected COPY-style statements, sitting inside message content, as a rough indicator of attempted exploitation. Because a successful attack grants root, teams should also assume that any appliance already compromised may have had its own logs tampered with to erase that evidence, which means a clean-looking log cannot be treated as proof the device was never hit. ## Questions **What is CVE-2026-76461?** It is a critical flaw in Cisco AsyncOS for Secure Email Gateway that lets an attacker send a crafted email containing SQL statements and end up with root-level command execution on the appliance, without needing any credentials. **Is there a workaround if I can't patch right away?** No. Cisco's advisory states there are no workarounds for this vulnerability, so patching to a fixed release is the only way to close it. **Which Cisco versions are affected?** AsyncOS for Secure Email Gateway 15.5 and earlier, 16.0, and 16.5, on both physical and virtual appliances. Secure Email and Web Manager and Secure Web Appliance are not affected. **Is this being actively exploited?** Yes. Cisco's PSIRT says it became aware of active exploitation in September 2026, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog with a September 17, 2026 remediation deadline for federal agencies. **How urgent is this for non-federal organizations?** Very. The bug requires no authentication, needs no user interaction, and grants root access on an internet-facing mail appliance, so any organization running an affected version should patch on the same timeline rather than wait for a deadline that only binds US federal agencies. ## Sources - [Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution](https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html), The Hacker News - [Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation](https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/), SecurityWeek - [Cisco Security Advisory: Cisco Secure Email Gateway SQL Injection Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX), Cisco