Cisco Secure Email Gateway: SQL Injection That Hits Via Email

TL;DR: CISA added CVE-2026-76461 to the KEV catalog on September 14 with a September 17 federal deadline. A critical (CVSS 9.8) SQL injection in Cisco Secure Email Gateway’s email parsing logic lets unauthenticated remote attackers execute arbitrary commands as root — no attachment needed, no click required. The attack payload lives in the email body. Cisco confirmed active exploitation in the wild. No workarounds exist. You upgrade or you’re owned.

The Vulnerability

CVE-2026-76461 lives in the email parsing path of Cisco AsyncOS Software. An attacker sends a crafted email containing malicious SQL statements through the affected device. AsyncOS doesn’t sufficiently sanitize the parsed content before injecting it into database queries. The result: arbitrary SQL execution, which chains into command execution with root privileges on the underlying OS.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthenticated. Network-attacked. Low complexity. No user interaction. Total impact.

This isn’t a flash-based attack or a URL-click exploit. The delivery channel is the same one every organization relies on: email. Your ESA is processing millions of messages a day. Each one is a potential injection point.

The CISA Timeline

CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14, 2026, with a September 17, 2026 remediation deadline under BOD 26-04. Three days. That’s CISA’s shortest practical tier — applied to internet-facing, actively exploited vulnerabilities with no workaround.

Cisco PSIRT disclosed the vulnerability simultaneously with the KEV addition. Active exploitation was confirmed at disclosure — meaning attackers were already sending payloads through production ESAs when the advisory dropped.

Affected Versions

All Cisco Secure Email Gateway releases are vulnerable — physical and virtual, regardless of configuration:

Release LineFirst Fixed Release
15.5 and earlier15.5.5-014
16.016.0.4-302
16.516.5.0-780

Cisco’s recommendation: migrate to 16.5.0-780 if running anything earlier.

Cisco Secure Email Cloud customers were already upgraded to 16.5.0-780. Cloud customers without direct CLI access may need to check with Cisco for compromise indicators — the company contacted affected customers directly.

No Workarounds

There are no workarounds. No config toggle. No ACL trick. No rate limit that blocks this. The SQL injection fires on email body content parsing, which every message traverses. The only mitigation is an upgrade.

How to Detect Exploitation

Cisco recommends searching the mail_logs for suspicious SQL statements. The key indicator:

cisco-esa> grep -i "COPY.*TO PROGRAM" mail_logs

Any match may indicate malicious activity. Note: post-exploitation threat actors may remove or hide their IOCs due to root-level access, so cross-check against external firewall and network logs for unexpected uploads from the ESA to external IPs, or downloads from malicious sources.

Cluster Considerations

If your ESA is in a cluster, SSH key pairs are used for inter-node authentication. A compromised node gives attackers access to the private SSH keys, which can be used to compromise other cluster members. Cisco’s recommendation: restore every member of a cluster that contains at least one compromised appliance.

Forensics Triage Requirements

Under BOD 26-04, KEV entries carry forensic triage requirements. For CVE-2026-76461:

  • Search mail_logs for COPY.*TO PROGRAM entries
  • Cross-check external firewall logs for suspicious uploads/downloads from the ESA
  • For virtual appliances: record forensics before deploying a new instance (config and logs are destroyed)
  • Renew credentials and cryptographic materials on the appliance
  • If physical: contact Cisco TAC with remote access enabled
  • For clusters: check every member, not just the suspected compromised node

What to Do Today

  1. Check your AsyncOS version — is it on a vulnerable release line?
  2. Upgrade to 16.5.0-780 (or the fixed release for your line)
  3. Search mail_logs for COPY.*TO PROGRAM
  4. If virtual and exploited: deploy new instance → rebuild config → renew credentials → monitor
  5. If cluster member exploited: restore all cluster members
  6. If cloud: check with Cisco for compromise indicators

The Takeaway

SQL injection in an email gateway is the kind of vulnerability that makes you realize how much trust you’ve placed in your own parsing logic. Your ESA processes millions of messages daily, and somewhere in that stream, someone is injecting SQL. The attack surface is the same channel your business relies on — email — and the payload is hidden in a body that looks like normal text to everything except the database query it eventually hits.

Three-day remediation windows don’t exist for vulnerabilities with no workaround and active exploitation. If you’re running an on-prem Cisco ESA and haven’t upgraded yet, you’re either lucky or you don’t check your logs.

Sources