Vulnerabilities · Threat Intelligence · Application Security
Cisco Secure Email Gateway flaw lets attackers take control: patch now, say CISA and Cisco
A critical flaw in Cisco Secure Email Gateway is being exploited to let attackers run commands as root. CISA and Cisco urge urgent patching, as attackers can hide their tracks.
Ross GrantUpdated 3 min read
The short version
A serious flaw in Cisco's Secure Email Gateway lets attackers take control of the device just by sending a specially crafted email. This could let them install malware or steal data. Cisco and US authorities say everyone using this product should update it right away.
What happened?
A critical vulnerability (CVE-2026-76461) in Cisco Secure Email Gateway is being actively exploited. Attackers can send a crafted email to run commands as root on affected devices. Cisco and CISA have urged urgent patching. The scale of attacks is not yet known.
What is the Cisco Secure Email Gateway vulnerability?
A critical vulnerability (CVE-2026-76461) has been found in Cisco Secure Email Gateway, a product widely used to filter and protect business email. The flaw is in the software's email parsing logic. It allows an unauthenticated attacker to send a specially crafted email that triggers a SQL injection, letting them run any command they want on the device with root (full) privileges. This means an attacker could take over the device completely, install malware, or use it as a launchpad for further attacks.
Cisco confirmed that both the physical and virtual versions of Secure Email Gateway are affected, regardless of how they are set up. Other Cisco products like Secure Email and Web Manager and Secure Web Appliance are not impacted.[SecurityWeek (opens in a new tab)][The Hacker News (opens in a new tab)]
How was the flaw discovered and exploited?
Cisco became aware of active exploitation of this vulnerability in September 2026. The company has not disclosed who is behind the attacks or how many organisations have been affected. However, Cisco has released indicators of compromise (IoCs) to help defenders check if their devices have been targeted. Because attackers can gain root access, they may be able to erase or hide evidence of their activity, making detection harder.[SecurityWeek (opens in a new tab)][The Hacker News (opens in a new tab)]
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 September 2026. This means CISA has confirmed the flaw is being used in real-world attacks. Federal agencies have been ordered to patch or mitigate the vulnerability by 17 September 2026.[CISA (opens in a new tab)]
What should defenders do?
Cisco has released software updates to fix the vulnerability. There are no workarounds: updating to the latest supported version is the only way to protect against this attack. Administrators should also check their mail logs for suspicious SQL statements, as described in Cisco's advisory. If the device is part of a cluster, logs from all cluster devices should be reviewed.
Because attackers with root access can hide their tracks, Cisco recommends checking network and firewall logs outside the affected device for signs of unusual uploads or downloads. Cisco has directly contacted customers whose cloud devices showed signs of compromise.[The Hacker News (opens in a new tab)]
Previous incidents and wider context
This is only the second Cisco Secure Email Gateway vulnerability to be listed in CISA's KEV catalogue. The previous one, CVE-2025-20393, was exploited by China-linked threat actors in late 2025. News of this latest flaw comes shortly after other Cisco products, such as Secure Firewall Management Center, were also found to be under attack by both state-sponsored and criminal groups.[SecurityWeek (opens in a new tab)]
What you should do
If your organisation uses Cisco Secure Email Gateway, update to the latest version immediately. Review Cisco's guidance for checking logs and look for any signs of compromise. If you suspect your device was affected, consider a full forensic investigation, as attackers may have hidden their activity. Organisations that fail to patch could face regulatory scrutiny and, in some jurisdictions, large fines if customer data is exposed.
Claimed vs confirmed
- Confirmed
Attackers can exploit CVE-2026-76461 to execute commands as root via a crafted email.
Cisco and CISA have confirmed this in advisories and public statements.
- Confirmed
Attackers can remove or hide evidence of compromise.
Cisco has warned that attackers with root access can hide or erase indicators of compromise.
- Confirmed
The scale of attacks is unknown.
Cisco has not disclosed how many organisations have been affected.
The impact
- Money
- Organisations that do not patch could face regulatory fines if customer data is exposed. Under GDPR, fines can reach up to €20 million or 4% of global turnover.
- Reputation
- A breach of email security can damage trust with customers and partners, especially if attackers use the device to spread malware or steal sensitive data.
- Customers
- If you use Cisco Secure Email Gateway, your email and possibly internal systems could be at risk. Update immediately and check logs for signs of compromise.
Why it matters
This vulnerability puts organisations that use Cisco Secure Email Gateway at risk of full device compromise. Attackers could use it to steal data, disrupt email, or move deeper into networks. The flaw is being used in real attacks, so urgent action is needed.
How does it work?
The vulnerability is a SQL injection in the email parsing logic of Cisco Secure Email Gateway. By sending a specially crafted email, an unauthenticated attacker can inject malicious SQL statements, leading to arbitrary command execution with root privileges on the device.
Key points
- Critical flaw in Cisco Secure Email Gateway lets attackers run commands as root.
- Attackers can exploit the flaw by sending a crafted email.
- Cisco and CISA urge immediate patching; no workaround is available.
- Attackers may be able to hide evidence of compromise.
- Check logs and update devices to prevent exploitation.
Sources
CISA
Government
- CISA adds Cisco Secure Email Gateway flaw CVE-2026-76461 to Known Exploited Vulnerabilities: Cisco Secure Email Gateway SQL Injection Vulnerability (opens in a new tab)
cisa.gov
- CISA adds Cisco Identity Services Engine flaw CVE-2026-76460 to Known Exploited Vulnerabilities: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (opens in a new tab)
cisa.gov
- CISA adds Cisco Secure Email Gateway flaw CVE-2026-76461 to Known Exploited Vulnerabilities: Cisco Secure Email Gateway SQL Injection Vulnerability (opens in a new tab)
SecurityWeek
Reference
The Hacker News
Reference
