Security Intelligence
Loading table of contents...
At a glance:
-
Cisco disclosed and patched an actively exploited vulnerability in Cisco Secure Email Gateway that allows a threat actor to gain root-level access to affected appliances.
-
The vulnerability can be triggered through normal email traffic, making email security gateways a direct target for exploitation.
-
Identifying affected appliances, applying Cisco's security updates, and investigating systems for signs of compromise are the most important actions for affected organizations.
Threat summary
On September 14, Cisco addressed a critical vulnerability in Cisco Secure Email Gateway that had been actively exploited prior to disclosure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on the same day.
Cisco Secure Email Gateway (formerly IronPort Email Security Appliance) is an email security appliance used to inspect inbound and outbound email for phishing, malware, spam, and business email compromise. Organizations commonly deploy the product at the email perimeter, where it processes messages from external senders before they reach users.
The flaw, tracked as CVE-2026-76461, is a Structured Query Language (SQL) injection vulnerability in Cisco AsyncOS email parsing functionality used by Secure Email Gateway. Cisco rated it a CVSS score of 9.8.
Due to insufficient input validation, a specially crafted email containing malicious SQL statements can trigger command execution on the underlying operating system with root privileges.
The vulnerability affects physical and virtual Secure Email Gateway appliances regardless of configuration. Exploitation occurs during normal email processing, allowing a threat actor to trigger the vulnerable functionality by sending a crafted email through an affected gateway. The attack does not require authentication, administrative access, or user interaction.
Cisco confirmed active exploitation of the vulnerability and released indicators of compromise to support investigations. Successful exploitation provides root-level access to the affected appliance. Cisco stated that threat actors obtaining this level of access may alter or remove evidence of compromise from the device, increasing the importance of reviewing external network, firewall, and logging systems during incident response.
Analysis
Cisco Secure Email Gateway sits at a critical point in the email delivery path, inspecting messages before they reach users and internal systems. As a result, a compromise of the gateway can affect a security control that organizations rely on to filter malicious email and enforce email security policies.
The vulnerable code is reached when Cisco Secure Email Gateway scans and processes email messages. A threat actor does not need to access an administrative interface, virtual private network (VPN), or management portal because the appliance performs the vulnerable action automatically as part of its normal operation. This allows exploitation attempts to be delivered through the same email traffic the gateway is designed to inspect.
This is the second actively exploited vulnerability affecting Cisco Secure Email Gateway appliances disclosed by Cisco within the past year. Earlier exploitation of CVE-2025-20393 demonstrates continued threat actor interest in email security infrastructure, which often occupies a trusted position within enterprise environments.
Because email security gateways are frequently deployed as dedicated security appliances, they may receive less day-to-day attention than user-facing servers or workstations. Maintaining an accurate inventory of gateway appliances, validating software versions against vendor advisories, and prioritizing security updates for internet-facing security infrastructure can help reduce exposure to future exploitation activity.
Mitigations
Organizations can identify exposure by inventorying physical and virtual Cisco Secure Email Gateway appliances and verifying their AsyncOS versions against Cisco's fixed releases. Remove the vulnerable email-parsing functionality that enables explotation by upgrading affected appliances to AsyncOS:
-
15.5.5-014
-
16.0.4-302, or
-
16.5.0-780
Cisco also recommends migration to version 16.5.0-780 where operationally feasible.
Cisco published indicators of compromise that can be used to identify suspicious SQL statements in appliance mail logs. Reviewing mail_logs across all devices in a cluster and correlating findings with firewall, network, and externally stored logging data can help identify exploitation attempts and post-compromise activity. This approach is particularly valuable because successful exploitation may allow a threat actor to alter or remove evidence from the affected appliance. Cisco also released Snort rules 67109 and 67110 to support detection efforts.
Where compromise is suspected, preserving forensic evidence before recovery activities begin helps maintain information that may be required for investigation. Cisco's recovery guidance for virtual appliances includes deploying a new instance running a fixed release, rebuilding the appliance configuration, and renewing credentials and cryptographic material installed on the system. Restricting management access to trusted hosts, disabling unnecessary network services, separating mail and management traffic, and forwarding logs to external systems can reduce administrative exposure and improve visibility during incident response.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
