An attacker who wants to take control of a Cisco Secure Email Gateway does not need a password, a stolen session or a way onto the network. They need to send it an email. Cisco disclosed on Monday that a flaw in the way its appliances parse incoming messages lets a crafted email run commands as root on the device, and that someone has already been using it.
The vulnerability is tracked as CVE-2026-76461. It lives in the email parsing logic of AsyncOS, the software that runs the gateway, and affects both physical and virtual appliances regardless of how they are configured. Cisco's advisory says the parser does not validate its input sufficiently: a message carrying malicious SQL statements can get those statements executed, and from there the attacker can run operating system commands with the highest privileges.
Cisco says its incident response team became aware of exploitation in September. It has not said who is responsible, how many customers were hit or what the intruders did once they were in.
Why the gateway is such a valuable target
An email security gateway sits where every inbound and outbound message passes through it. That is its job. A machine in that position, fully controlled by an outsider, is an eavesdropping post on an organization's correspondence, and in the worse case a place from which messages can be altered or withheld.
Where the gateway runs matters for what comes next. An appliance installed in a company's own data center usually has network access to mail servers and directory services, so a compromised one gives an intruder a starting point for moving further inside. A gateway hosted in Cisco's cloud is more isolated from the customer's internal systems, although the mail flowing through it is just as exposed.
Cisco says it investigated the devices in its hosted Secure Email Cloud service and contacted the customers whose devices showed signs of possible compromise. It has already applied the mitigations that are within its own control and is working with those customers on recovery. Organizations that run their own appliances have to install the fixed software themselves.
Patching and checking
The US cybersecurity agency CISA added the flaw to its Known Exploited Vulnerabilities catalog on the day of the disclosure and gave federal agencies three days, until September 17, to patch.
Cisco has published indicators of compromise. Its main suggestion is to search the mail_logs on every device in a cluster for suspicious SQL statements. It also warns that this may not be enough, because an attacker with root access can delete or hide those traces. Administrators are advised to compare what the appliance says with network and firewall logs, looking in particular for transfers to or from unfamiliar external addresses.
The same batch of advisories fixed four further critical flaws in Secure Email Gateway and in the Secure Email and Web Manager appliance. Cisco says it has no evidence that any of those have been exploited. It is the second time this year that the product family has needed an urgent fix: in January the company patched a maximum severity AsyncOS bug that had been under attack since November 2025.
