Cisco released a security advisory about a critical-severity vulnerability in Cisco Secure Email Gateway. Tracked as CVE-2026-76461, the vulnerability is being exploited in the wild. Successful exploitation of the vulnerability may allow an attacker to execute arbitrary commands with root privileges on the underlying operating system. Cisco TAC team discovered the vulnerability.
CISA acknowledged the active exploitation of the vulnerability by adding to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch it before September 17, 2026.
Cisco Secure Email Gateway (SEG) is a device or software that monitors and protects email from unwanted content, such as spam, phishing attacks, malware, and other fraudulent messages.
Cisco offers multiple SEG products, including:
- Cisco Email Security Appliance (ESA)
- Cisco Secure Email Cloud Gateway
- Cisco Secure Email Essentials
Vulnerability Details
This vulnerability originates from an insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email containing malicious SQL statements via an affected device. Successful exploitation of the vulnerability could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Indicator of Compromises
To verify whether this vulnerability has been exploited, examine the mail_logs for anomalous SQL statements. If the device is part of a cluster, review the logs of each cluster device. The following is a non-exhaustive example of how a malicious SQL statement could be detected in the logs:
cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]
The presence of any entry in the output may indicate malicious activity.
Affected and Patched Versions
The vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration.
| Cisco AsyncOS for Cisco Secure Email Gateway Software Release | First Fixed Release |
|---|---|
| 15.5 and earlier | 15.5.5-014 |
| 16.0 | 16.0.4-302 |
| 16.5 | 16.5.0-780 |
Note: Cisco strongly recommends users migrate to Release 16.5.0-780.
For more information, please refer to Cisco Security Advisory (cisco-sa-esa-inj-2bLVGmhX).
Qualys Detection
Qualys customers can scan their devices with QID 317880 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
