---
title: "Cisco Secure Email Gateway: Two Exploited Root RCE Bugs"
url: https://erroneo.us/security/briefs/cisco-secure-email-gateway-cve-2026-76461-76519-root-rce/
description: "Crafted emails give unauthenticated root on Cisco Secure Email Gateway (CVE-2026-76461, -76519), both in KEV. Move to 16.5.0-780 or 15.5.5-014 and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-09-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-76461", "CVE-2026-76519", "CVE-2026-76440"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco Secure Email Gateway: Two Exploited Root RCE Bugs

**Verdict: Act now.** Every on-premises Secure Email Gateway below 15.5.5-014 or 16.5.0-780 can be rooted by an email and both bugs are exploited: upgrade now, and check for compromise before and after, because attackers can wipe local evidence.

- **Who must act:** Anyone running physical or virtual Cisco Secure Email Gateway on AsyncOS before 15.5.5-014, 16.0.x, or 16.5 before 16.5.0-780, including teams that moved to 16.0.4-302, which fixes only CVE-2026-76461.
- **Who can relax:** Secure Email and Web Manager and Secure Web Appliance are not affected by these two CVEs, and Cisco has already upgraded Secure Email Cloud devices (but contacted cloud customers must rotate credentials).
- **Affected:** CVE-2026-76461: Secure Email Gateway 15.5 and earlier before 15.5.5-014, 16.0 before 16.0.4-302, 16.5 before 16.5.0-780 (any configuration); CVE-2026-76519: Secure Email Gateway 15.5 before 15.5.5-014, all 16.0, 16.5 before 16.5.0-780, when File Reputation is enabled on a mail policy and Content Scanner Tools is before 25.3.0.5525
- **Fixed:** AsyncOS 16.5.0-780 (fixes both; Cisco's recommendation); AsyncOS 15.5.5-014 (fixes both); AsyncOS 16.0.4-302 (CVE-2026-76461 only); Content Scanner Tools 25.3.0.5525 or later (CVE-2026-76519, no restart); Secure Email and Web Manager hardening release: 15.5.5-006 / 16.5.0-429
- **CVEs:** CVE-2026-76461, CVE-2026-76519, CVE-2026-76440
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every gateway and cluster member and its AsyncOS release (version at the CLI).
2. Before upgrading, run Cisco's IOC checks on every appliance; on virtual appliances, collect forensic data first.
3. Upgrade to 16.5.0-780, or at minimum 15.5.5-014 (CLI: upgrade, then DOWNLOADINSTALL); 16.0 users must migrate.
4. Run contentscannerstatus and, if below 25.3.0.5525, run contentscannerupdate and enable automatic service updates.
5. If indicators are found: open a TAC case (physical) or redeploy a fresh VM on a fixed release without importing the old config (virtual), rotate credentials and keys, and restore every member of an affected cluster.
6. Keep management off the internet, separate mail and management interfaces, disable HTTP/FTP and forward logs to an external server.
7. Upgrade Secure Email and Web Manager to 15.5.5-006 or 16.5.0-429 for the related hardening release.

### How to check if you are affected

- On each cluster member, run grep -i "COPY.*TO PROGRAM" mail_logs; any match may indicate CVE-2026-76461 exploitation.
- Run grep "System Security" system_logs; 'Suspected compromise indicator was found' or 'Security scan did not complete' means contact TAC.
- Check firewall and proxy logs for unexpected uploads from the gateway to external IPs or downloads from unknown hosts, since root-level attackers can scrub local logs.
- Enable Snort rules 67109-67110, which Cisco lists for CVE-2026-76461.

## What happened

On September 14, 2026, Cisco published [cisco-sa-esa-inj-2bLVGmhX](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX) for CVE-2026-76461, a SQL injection (CWE-89) in the email parsing logic of AsyncOS for Cisco Secure Email Gateway. An unauthenticated attacker only has to send a crafted message containing SQL statements through the gateway to run commands as root. Cisco rates it CVSS 3.1 9.8 and says it affects physical and virtual appliances "regardless of device configuration." The bug surfaced during a TAC support case, and Cisco PSIRT learned of active exploitation in September 2026. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461) the same day.

Cisco also shipped a [hardening release](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm) that day for internally found flaws, including CVE-2026-76440, a group of path traversal issues. On October 14, Cisco published [cisco-sa-esa-afw-zqYJkjxp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp) for CVE-2026-76519, a relative path traversal (CWE-23) in the Advanced Malware Protection (AMP) file reputation feature. A crafted attachment lets an unauthenticated attacker write arbitrary files and run commands as root. It is also rated 9.8, PSIRT learned of exploitation in October, and it entered [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519) the same day. [SecurityWeek](https://www.securityweek.com/cisco-warns-of-exploited-secure-email-gateway-vulnerability/) reports that its fix shipped in the September releases under CVE-2026-76440.

Cisco has not attributed either campaign or said how many appliances were hit, and we found no Talos analysis as of October 21, 2026. The [Sophos Counter Threat Unit](https://www.sophos.com/en-us/blog/cisco-secure-email-gateway-vulnerability-cve-2026-76461-in-active-exploitation) flagged CVE-2026-76461 but published no indicators.

## Who is affected

On-premises Secure Email Gateway, physical or virtual, on AsyncOS below the fixed releases ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-76461), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-76519)):

- **CVE-2026-76461:** every configuration. Fixed in 15.5.5-014 (15.5 and earlier), 16.0.4-302 and 16.5.0-780.
- **CVE-2026-76519:** only when File Reputation is enabled and assigned to a mail policy **and** Content Scanner Tools is older than 25.3.0.5525. Fixed in 15.5.5-014 and 16.5.0-780, or by updating Content Scanner Tools. There is no 16.0 fix.

Secure Email and Web Manager and Secure Web Appliance are not affected by either CVE, though the Manager is covered by the hardening release (15.5.5-006 or 16.5.0-429). Cisco says it has upgraded all Secure Email Cloud devices to 16.5.0-780 and contacted cloud customers where it saw malicious activity.

## Do you really need to act?

Yes, if an on-premises gateway is not on 15.5.5-014 or 16.5.0-780. The attack surface is the gateway's core job, accepting mail from the internet. No login, no user click and, for CVE-2026-76461, no special feature is needed, and Cisco confirms both bugs are exploited. Any gateway with AMP file reputation on a mail policy meets the CVE-2026-76519 condition unless Content Scanner Tools is already current, so check rather than assume automatic updates covered you.

Patching is not the end of it. Root on a mail gateway exposes mail flow, stored credentials and the SSH keys cluster members use to trust each other, and Cisco warns attackers may hide or remove evidence. A gateway that sat on a vulnerable release in September or October should be checked with Cisco's indicators before and after upgrading. Teams that moved to 16.0.4-302 for the first bug are still exposed to the second.

## What to do now

1. List every gateway and cluster member and its release (`version` at the CLI).
2. Run the checks below on each appliance before upgrading. On virtual appliances, collect forensic data first; Cisco notes that redeploying destroys configuration and logs.
3. Upgrade to 16.5.0-780 (Cisco's recommendation for anything earlier than 16.5) or at minimum 15.5.5-014: CLI `upgrade`, then `DOWNLOADINSTALL`, or System Administration > System Upgrade.
4. Run `contentscannerstatus`. If it is older than 25.3.0.5525, run `contentscannerupdate` and enable automatic service updates; this closes CVE-2026-76519 without a restart.
5. If you find indicators, open a TAC case for physical appliances. For virtual ones, deploy a fresh VM on a fixed release, rebuild the configuration without importing the old file, rotate credentials and keys, and restore every member of an affected cluster.
6. Apply Cisco's hardening advice: no internet access to management, separate mail and management interfaces, external log forwarding, HTTP and FTP disabled.

## How to tell if you were hit

For CVE-2026-76461, Cisco suggests searching mail logs for SQL that shells out, for example `grep -i "COPY.*TO PROGRAM" mail_logs` on every cluster member; any match may indicate malicious activity. Cisco also lists Snort rules 67109-67110. For CVE-2026-76519, run `grep "System Security" system_logs`. "Suspected compromise indicator was found" means compromise; "Security scan did not complete" means contact TAC; "No compromise indicator was found" means none was detected. Because root-level attackers can scrub local logs, also check firewall and proxy logs for unexpected uploads from the gateway to external IPs or downloads from unknown hosts, as [The Hacker News](https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html) relays from Cisco.

## Timeline

- Sep 14, 2026 — Cisco publishes the CVE-2026-76461 advisory and the September hardening release (15.5.5-014, 16.0.4-302, 16.5.0-780). CISA adds CVE-2026-76461 to KEV.
- Sep 17, 2026 — Cisco adds cluster guidance to the advisory; CISA deadline for CVE-2026-76461.
- Oct 14, 2026 — Cisco publishes CVE-2026-76519 as exploited and links it from the hardening advisory. CISA adds it to KEV.
- Oct 17, 2026 — CISA deadline for CVE-2026-76519.

## Sources

1. [Cisco — Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX)
2. [Cisco — Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)
3. [Cisco — Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm)
4. [CVE record — CVE-2026-76461](https://www.cve.org/CVERecord?id=CVE-2026-76461)
5. [CVE record — CVE-2026-76519](https://www.cve.org/CVERecord?id=CVE-2026-76519)
6. [NVD — CVE-2026-76461](https://nvd.nist.gov/vuln/detail/CVE-2026-76461)
7. [NVD — CVE-2026-76519](https://nvd.nist.gov/vuln/detail/CVE-2026-76519)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-76461](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461)
9. [CISA — Known Exploited Vulnerabilities: CVE-2026-76519](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519)
10. [Sophos CTU — Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation](https://www.sophos.com/en-us/blog/cisco-secure-email-gateway-vulnerability-cve-2026-76461-in-active-exploitation)
11. [The Hacker News — Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution](https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html)
12. [SecurityWeek — Cisco Warns of Exploited Secure Email Gateway Vulnerability](https://www.securityweek.com/cisco-warns-of-exploited-secure-email-gateway-vulnerability/)

---
Source page: https://erroneo.us/security/briefs/cisco-secure-email-gateway-cve-2026-76461-76519-root-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt