Skip to content

Cisco Secure Email Gateway CVE-2026-76461: unauthenticated SQL injection in email parsing to root — KEV-listed with a Sep 17 deadline, and Cisco already contacted cloud customers it saw under attack

Tags

Summary

On September 14, 2026, Cisco published advisory cisco-sa-esa-inj-2bLVGmhX (initial public release, final, 2026-SEP-14) for CVE-2026-76461, a SQL injection vulnerability in the email-parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway (SEG): an unauthenticated, remote attacker sends a crafted email message containing malicious SQL statements through an affected device; insufficient validation in the email-parsing path lets the attacker execute arbitrary SQL statements, leading to arbitrary command execution with root privileges on the underlying OS. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-89.

CISA added it to the KEV catalog the same day — the sole addition in catalog 2026.09.14 (1,710 entries), BOD 26-04, Forensics Triage required, due 2026-09-17, ransomware use unknown, no actor named.

Two facts elevate this above a routine critical CVE:

  1. There are no workarounds, and the device is exposed by its function: every email routed through the appliance touches the vulnerable parser, regardless of device configuration. Cisco states physical and virtual SEG are affected "regardless of device configuration."
  2. Cisco has directly contacted customers who own Cisco Secure Email Cloud devices on which malicious activity was detected. That is the vendor telling you, as plainly as a press release allows, that it observed exploitation attempts against its own managed cloud fleet. Cloud tenants without CLI access cannot even check their own IOCs — Cisco checks for them.

The flaw

  • Entry point: a crafted email routed through the gateway. No authentication, no user interaction, no special configuration required.
  • Mechanism: insufficient validation in email-parsing logic → attacker-supplied SQL executes against an internal SQL-backed store → command execution as root on the underlying OS. Cisco's published IOC sample shows the command-execution primitive is PostgreSQL-style COPY ... TO PROGRAM.
  • Affected: Cisco Secure Email Gateway (physical and virtual). Not affected: Secure Email and Web Manager (CUMA) and Secure Web Appliance.
  • Workarounds: none. The parser itself is the flaw.

Fixed releases

AsyncOS line First fixed release
15.5 and earlier 15.5.5-014 (Cisco strongly recommends migrating to 16.5.0-780)
16.0 16.0.4-302 (same recommendation)
16.5 16.5.0-780

Upgrade via the web interface (System Administration → System Upgrade → Upgrade Options → Download and Install) or CLI (upgrade → DOWNLOADINSTALL). Cisco Secure Email Cloud: all cloud devices have already been upgraded to 16.5.0-780 by Cisco's maintenance process.

Compromise assessment (Cisco's published guidance)

  • Review mail_logs for suspicious SQL; Cisco's non-exhaustive example: cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs, default: mail_logs] Any hit may indicate malicious activity. In a cluster, review every node's logs.
  • Assume local evidence is untrustworthy: Cisco warns that after successful exploitation, threat actors with root "may remove or hide evidence of exploitation and indicators of compromise." Cross-check network and firewall logs outside the impacted device — specifically unexpected uploads initiated from the appliance to external IP addresses, or downloads from malicious IPs.
  • Secure Email Cloud tenants without CLI access cannot run these checks independently; Cisco directly contacted customers whose cloud devices showed malicious activity. Absence of contact is meaningful but not a guarantee — request confirmation from Cisco TAC if SEG Cloud is in your mail path.

Why this pattern matters

  • Email security appliances are pre-authentication, always-on, internet-facing message parsers — the same target class as VPN concentrators and routers, but sitting inline on the organization's entire mail flow. A root foothold on an SEG is persistent visibility into (and the ability to modify) every message in and out, plus a dual-homed pivot between the internet edge and the internal network.
  • This is the second Cisco security-appliance root flaw under active exploitation in September 2026, after Secure FMC CVE-2026-20079 (KEV Sep 9, deadline Sep 12; Talos tied it to three actor clusters including a Sandworm-overlap APT and a Qilin operator — see related pages). The management plane and the email edge are the two federal-deadline hot zones of the month; audit internet exposure of both first.
  • COPY ... TO PROGRAM in any log that carries SQL from a parser or appliance component is a durable, low-noise hunt string beyond this CVE.

Actions

  1. Patch to 16.5.0-780 now. Federal due date September 17; everyone else should treat it identically — there is no stopgap.
  2. Before and after patching, grep mail_logs for COPY.*TO PROGRAM on every cluster node and retain the evidence.
  3. Hunt external network/firewall logs for uploads originating from the appliance (the attacker can erase the device; your perimeter firewall cannot be erased by them).
  4. Cloud SEG tenants: confirm patch state and contact status in writing via Cisco.
  5. On confirmed compromise: assume total mail-flow visibility/tamper exposure and an attacker-controlled foothold on a network segment that bridges external and internal — full rebuild from Cisco images, not in-place cleanup.

References