CVE-2026-76461

This vulnerability lets someone send a specially crafted email to your Cisco secure email gateway. Instead of safely handling the message, the gateway can be tricked into running database code and then running operating-system commands with the device’s highest privileges.

Think of it like a mailroom door that was supposed to be locked—an attacker slips in via a letter and then takes control of the building’s master power switch.

This matters if you run Cisco AsyncOS Software for Cisco Secure Email Gateway and it is connected to the internet in a way that allows it to receive email from external senders. Because the attack needs no login and no user interaction, a typical business mail flow can be enough for exposure.

The risk is highest when the vulnerable gateway is internet-reachable and actively receiving email traffic; if it cannot be reached from the internet or inbound mail is blocked, exposure is much lower.

This is RED because there is confirmed active exploitation in the wild, meaning attackers are already using crafted emails to compromise exposed gateways. CISA has added it to its KEV list with a remediation due date of 2026-09-17, so delays create immediate risk.

Given the ability to run commands as root, a successful attack can quickly turn into full control of the device and disruption of your email operations.

1. Identify exposure

   • Determine whether you use Cisco AsyncOS Software for Cisco Secure Email Gateway.
   • Confirm the device is running vulnerable software by checking the current AsyncOS version.
   • Confirm whether the gateway is reachable from the internet and receiving external email traffic (the findings note it is reachable in default configuration and requires no authentication or user interaction).

2. Confirm whether you are on a fixed version

   • The fixed version provided by Cisco is: asyncos fixed in 15.5.5-014.
   • If your AsyncOS version is older than 15.5.5-014, treat the system as affected.

3. Upgrade remediation (primary)

   • Upgrade AsyncOS to 15.5.5-014 (or later) following Cisco’s remediation steps in their advisory.
   • Plan the upgrade to minimize email downtime (a reboot or service restart may be required depending on deployment).

4. If patching is delayed

   • Reduce internet exposure immediately: ensure the gateway is not directly reachable from the public internet for untrusted traffic.
   • Block inbound paths that allow untrusted emails to reach the gateway until it is patched or mitigations are applied.
   • Apply any interim mitigations provided by Cisco (the KEV guidance points to following vendor instructions).

5. KEV timing and forensics expectations

   • CISA KEV due date: 2026-09-17.
   • Keep in mind CISA’s guidance references forensics triage requirements; if you suspect compromise, preserve relevant logs and telemetry before wiping/re-imaging.

6. What to monitor after patching

   • Monitor gateway logs for signs of malicious email-triggered behavior.
   • Watch for unexpected administrative actions or changes that could indicate command execution following exploitation.
   • Validate normal mail processing after upgrade.

Severity is critical in practice: the findings describe capability for arbitrary system command execution with highest administrative rights (root) via unauthenticated, network-reachable SQL injection (CWE-89) in Cisco AsyncOS email parsing.

Mechanism: attackers send a crafted email message that injects malicious SQL into the vulnerable parsing/processing path; successful exploitation leads to SQL execution and then OS command execution as root.

Exploitation status: actively exploited in the wild (KEV added; CISA KEV listing is confirmed) and public exploits are available, indicating high attacker confidence and maturity.

EPSS is not used for public urgency decisions here because KEV/news exploitation confirmation takes precedence.

KEV meaning: being listed in CISA KEV indicates known exploitation and triggers faster remediation expectations. The KEV record also specifies applying mitigations per vendor instructions, complying with BOD 26-04 guidance, and ensuring stakeholders evaluate internet exposure and patching/discontinuation if mitigations are unavailable.