Build1 publisher2 min readPublished
Cisco email gateway flaw runs attacker SQL as root the moment it parses a message
CVE-2026-76461 lets a crafted email run SQL as root on Cisco Secure Email Gateway, with no workaround and a September 17 federal patch deadline from CISA. Because the trigger is mail parsing, every gateway in the mail path is in scope, whether or not it faces the internet.
The Engineer · Build desk
What happened
- CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14.
- Cisco says the flaw does not depend on configuration and affects both physical and virtual appliances.
- ZoomEye counts collected on September 19 measure the deployed population but do not expose the AsyncOS version that decides whether a gateway is vulnerable.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Reachability-based scanning cannot rank this bug, so inventory has to come from the asset database.
- exposure A single crafted email is enough to reach root, so inbound mail flow itself is the attack surface for every organization running the appliance.
- decision Root access means patching alone does not close the incident; each cluster's mail_logs need a hunt for COPY.*TO PROGRAM before the box is trusted again.
- cost Federal agencies had three days between the September 14 listing and the September 17 deadline to inventory and patch, with no workaround to buy time.
The vulnerable code runs the moment mail arrives, so there is no setting to disable and no relay arrangement that moves a gateway out of range [5]. The injected SQL executes with root privileges [1]. Cisco has shipped fixed AsyncOS builds and offers nothing to apply in the meantime [2][10].
That breaks the usual assumption behind exposure scanning. For most edge bugs the attacker first has to reach the vulnerable service over the network, so a service that is not internet-facing is not in scope [4]. Here the precondition is a message, not a connection [4].
Population scanning still has one honest use: inventory. ZoomEye queries run on September 19 return counts of matching records, and any matching record could be a patched device or a vulnerable one [6]. Query wording decides the count. The query app="IronPort" returns far more records than app="Cisco Secure Email Gateway", because IronPort is the older brand for the same family and still shows up in banners, certificates and management interfaces [7]. A fleet counted by one product string alone comes out low [16]. The query app="Cisco Email Security" returned zero. That means no fingerprint matched that exact string; such devices may still exist [8].
None of these counts reveals the AsyncOS version, and the version is the only thing separating a patched gateway from an exploitable one [9]. The fixed releases are 15.5.5-0141, 16.0.4-3021 and 16.5.0-780, and Cisco recommends 16.5.0-780 where possible [10]. Both physical and virtual appliances are affected [11].
Because the injection lands as root, the work continues after the upgrade [12]. Cisco's guidance is to treat the patch as a forensic checkpoint and search mail_logs on every cluster member for anomalous SQL, starting with the pattern COPY.*TO PROGRAM [12]. Root also lets an intruder delete local traces, so the evidence worth keeping sits in traffic and firewall logs collected off the box [13]. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected [14].
What to watch
- Whether Cisco or CISA reports exploitation counts or indicators beyond the KEV listing.
- Whether fingerprint scanners add AsyncOS version detection, turning population counts into vulnerable-device counts.
- Whether federal agencies met the September 17 deadline and what enforcement follows.