Cisco Fixes Active Zero-Day Exploit in Email Gateway

Active Zero-Day Exploit Targeting Cisco Email Gateways

Cisco has confirmed that threat actors are actively exploiting a zero-day SQL injection vulnerability, identified as CVE-2026-76461, within its Secure Email Gateway appliances. The vendor’s Product Security Incident Response Team (PSIRT) detected this active exploitation in September 2025. To assist organizations in determining if they have been breached, the company has released specific indicators of compromise (IOCs) for security teams to monitor.

The flaw impacts Cisco AsyncOS Software versions 16.5, 16.0, and 15.5 or earlier running on both physical and virtual on-premises Secure Email Gateway devices. Additionally, the cloud-delivered service, known as Cisco Secure Email Cloud, was also vulnerable. Cisco stated it “has directly contacted customers who own Cisco Secure Email Cloud devices on which malicious activity was detected.”

Understanding the Vulnerability and Impact

The root cause of CVE-2026-76461 lies in insufficient validation within the email parsing logic. An unauthenticated attacker can trigger the flaw by sending a crafted email containing malicious SQL statements through an affected device. Crucially, successful exploitation does not require any interaction from end-users.

The consequences of a successful attack are severe. As Cisco explained, “A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.” This level of access allows attackers to fully control the underlying infrastructure.

Detection Challenges and Log Analysis

Organizations using Cisco Secure Email Gateway should immediately check their mail_logs for suspicious SQL statements. Cisco advised that “The presence of any entry in the output may indicate malicious activity. If the device is part of a cluster, review the logs of each cluster device.”

However, detection efforts face significant hurdles. Because attackers gain root privileges upon successful exploitation, they often delete or hide evidence to cover their tracks. For instance, last year a suspected Chinese-nexus threat group utilized log-purging tools after compromising systems via CVE-2025-20393. Consequently, Cisco warned that relying solely on internal appliance logs may be insufficient.

To mitigate this risk, the company noted that “Cisco strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”

Remediation Steps and Official Updates

Cisco has already upgraded all Cisco Secure Email Cloud devices to Release 16.5.0-780. For on-premises deployments, the vendor recommends upgrading to one of the following fixed releases: 15.5.5-014, 16.0.4-302, or 16.5.0-780. The latter version is preferred as it serves as a software hardening release that also addresses multiple other critical vulnerabilities discovered by the vendor.

Following an upgrade, security teams must search for IOCs across various logs. If evidence of compromise is found, response protocols differ based on hardware type. For physical devices, administrators should contact the Cisco Technical Assistance Center (TAC) for support. For virtual environments, teams should record forensics information, deploy a new virtual machine with a fixed software release, rebuild the product configuration, renew credentials and cryptographic materials, and continuously monitor for anomalous behavior.

In response to the urgency of the situation, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on Monday. The agency ordered US federal civilian agencies to remediate the flaw and check for signs of compromise by Thursday, September 17.