Cisco Secure Email Gateway: Two Exploited Root RCE Bugs

What to do

1. List every gateway and cluster member and its AsyncOS release (version at the CLI).
2. Before upgrading, run Cisco's IOC checks on every appliance; on virtual appliances, collect forensic data first.
3. Upgrade to 16.5.0-780, or at minimum 15.5.5-014 (CLI: upgrade, then DOWNLOADINSTALL); 16.0 users must migrate.
4. Run contentscannerstatus and, if below 25.3.0.5525, run contentscannerupdate and enable automatic service updates.
5. If indicators are found: open a TAC case (physical) or redeploy a fresh VM on a fixed release without importing the old config (virtual), rotate credentials and keys, and restore every member of an affected cluster.
6. Keep management off the internet, separate mail and management interfaces, disable HTTP/FTP and forward logs to an external server.
7. Upgrade Secure Email and Web Manager to 15.5.5-006 or 16.5.0-429 for the related hardening release.

How to check if you are affected or compromised

• On each cluster member, run grep -i "COPY.*TO PROGRAM" mail_logs; any match may indicate CVE-2026-76461 exploitation.
• Run grep "System Security" system_logs; 'Suspected compromise indicator was found' or 'Security scan did not complete' means contact TAC.
• Check firewall and proxy logs for unexpected uploads from the gateway to external IPs or downloads from unknown hosts, since root-level attackers can scrub local logs.
• Enable Snort rules 67109-67110, which Cisco lists for CVE-2026-76461.

What happened#

On September 14, 2026, Cisco published cisco-sa-esa-inj-2bLVGmhX for CVE-2026-76461, a SQL injection (CWE-89) in the email parsing logic of AsyncOS for Cisco Secure Email Gateway. An unauthenticated attacker only has to send a crafted message containing SQL statements through the gateway to run commands as root. Cisco rates it CVSS 3.1 9.8 and says it affects physical and virtual appliances "regardless of device configuration." The bug surfaced during a TAC support case, and Cisco PSIRT learned of active exploitation in September 2026. CISA added it to the KEV catalog the same day.

Cisco also shipped a hardening release that day for internally found flaws, including CVE-2026-76440, a group of path traversal issues. On October 14, Cisco published cisco-sa-esa-afw-zqYJkjxp for CVE-2026-76519, a relative path traversal (CWE-23) in the Advanced Malware Protection (AMP) file reputation feature. A crafted attachment lets an unauthenticated attacker write arbitrary files and run commands as root. It is also rated 9.8, PSIRT learned of exploitation in October, and it entered KEV the same day. SecurityWeek reports that its fix shipped in the September releases under CVE-2026-76440.

Cisco has not attributed either campaign or said how many appliances were hit, and we found no Talos analysis as of October 21, 2026. The Sophos Counter Threat Unit flagged CVE-2026-76461 but published no indicators.

Who is affected#

On-premises Secure Email Gateway, physical or virtual, on AsyncOS below the fixed releases (CVE record, NVD):

• CVE-2026-76461: every configuration. Fixed in 15.5.5-014 (15.5 and earlier), 16.0.4-302 and 16.5.0-780.
• CVE-2026-76519: only when File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Fixed in 15.5.5-014 and 16.5.0-780, or by updating Content Scanner Tools. There is no 16.0 fix.

Secure Email and Web Manager and Secure Web Appliance are not affected by either CVE, though the Manager is covered by the hardening release (15.5.5-006 or 16.5.0-429). Cisco says it has upgraded all Secure Email Cloud devices to 16.5.0-780 and contacted cloud customers where it saw malicious activity.

Do you really need to act?#

Yes, if an on-premises gateway is not on 15.5.5-014 or 16.5.0-780. The attack surface is the gateway's core job, accepting mail from the internet. No login, no user click and, for CVE-2026-76461, no special feature is needed, and Cisco confirms both bugs are exploited. Any gateway with AMP file reputation on a mail policy meets the CVE-2026-76519 condition unless Content Scanner Tools is already current, so check rather than assume automatic updates covered you.

Patching is not the end of it. Root on a mail gateway exposes mail flow, stored credentials and the SSH keys cluster members use to trust each other, and Cisco warns attackers may hide or remove evidence. A gateway that sat on a vulnerable release in September or October should be checked with Cisco's indicators before and after upgrading. Teams that moved to 16.0.4-302 for the first bug are still exposed to the second.

What to do now#

1. List every gateway and cluster member and its release (version at the CLI).
2. Run the checks below on each appliance before upgrading. On virtual appliances, collect forensic data first; Cisco notes that redeploying destroys configuration and logs.
3. Upgrade to 16.5.0-780 (Cisco's recommendation for anything earlier than 16.5) or at minimum 15.5.5-014: CLI upgrade, then DOWNLOADINSTALL, or System Administration > System Upgrade.
4. Run contentscannerstatus. If it is older than 25.3.0.5525, run contentscannerupdate and enable automatic service updates; this closes CVE-2026-76519 without a restart.
5. If you find indicators, open a TAC case for physical appliances. For virtual ones, deploy a fresh VM on a fixed release, rebuild the configuration without importing the old file, rotate credentials and keys, and restore every member of an affected cluster.
6. Apply Cisco's hardening advice: no internet access to management, separate mail and management interfaces, external log forwarding, HTTP and FTP disabled.

How to tell if you were hit#

For CVE-2026-76461, Cisco suggests searching mail logs for SQL that shells out, for example grep -i "COPY.*TO PROGRAM" mail_logs on every cluster member; any match may indicate malicious activity. Cisco also lists Snort rules 67109-67110. For CVE-2026-76519, run grep "System Security" system_logs. "Suspected compromise indicator was found" means compromise; "Security scan did not complete" means contact TAC; "No compromise indicator was found" means none was detected. Because root-level attackers can scrub local logs, also check firewall and proxy logs for unexpected uploads from the gateway to external IPs or downloads from unknown hosts, as The Hacker News relays from Cisco.

Timeline#

• Sep 14, 2026 — Cisco publishes the CVE-2026-76461 advisory and the September hardening release (15.5.5-014, 16.0.4-302, 16.5.0-780). CISA adds CVE-2026-76461 to KEV.
• Sep 17, 2026 — Cisco adds cluster guidance to the advisory; CISA deadline for CVE-2026-76461.
• Oct 14, 2026 — Cisco publishes CVE-2026-76519 as exploited and links it from the hardening advisory. CISA adds it to KEV.
• Oct 17, 2026 — CISA deadline for CVE-2026-76519.

Vulnerability records

• CVE-2026-76461 · KEV 2026-09-14 · A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute…
• CVE-2026-76519 · KEV 2026-10-14 · A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write…
• CVE-2026-76440 · As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Cisco — Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX) sec.cloudapps.cisco.com
2. Cisco — Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp) sec.cloudapps.cisco.com
3. Cisco — Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 sec.cloudapps.cisco.com
4. CVE record — CVE-2026-76461 cve.org
5. CVE record — CVE-2026-76519 cve.org
6. NVD — CVE-2026-76461 nvd.nist.gov
7. NVD — CVE-2026-76519 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-76461 cisa.gov
9. CISA — Known Exploited Vulnerabilities: CVE-2026-76519 cisa.gov
10. Sophos CTU — Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation sophos.com

Coverage and analysis

1. The Hacker News — Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution thehackernews.com
2. SecurityWeek — Cisco Warns of Exploited Secure Email Gateway Vulnerability securityweek.com