This content was generated with the help of AI and published without prior human review. It may contain errors and is not professional advice. Report a problem: info@delionsoft.com.
Cisco has published an advisory about a critical vulnerability in AsyncOS for Secure Email Gateway that is already being exploited. Tracked as CVE-2026-76461 with a CVSS score of 9.8, it lets an unauthenticated remote attacker reach root-level command execution by sending a specially crafted message. There is no workaround: the only remedy is an upgrade to a fixed release.
What happened
According to the original report, the root cause is insufficient validation in the email parsing logic. A crafted message containing malicious SQL statements can be processed by the appliance, leading to arbitrary SQL execution and, from there, command execution as root on the underlying operating system.
Both physical and virtual Secure Email Gateway deployments are affected, independent of device configuration. Cisco states that Secure Email and Web Manager and Secure Web Appliance are not affected. Fixes are available for release 15.5 and earlier (15.5.5-0141), 16.0 (16.0.4-302) and 16.5 (16.5.0-780).
Cisco says it learned of active exploitation this month and has contacted customers of Secure Email Cloud devices where malicious activity was observed. The scale of the attacks was not disclosed. CISA added the CVE to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 17 September 2026 for US federal civilian agencies — a useful signal of urgency for everyone else.
For detection, the advisory suggests reviewing mail_logs for suspicious SQL statements, checking every node if the device is part of a cluster, and grepping the mail logs for COPY.*TO PROGRAM. Any match should be treated as a possible sign of compromise. Because successful exploitation gives root access, Cisco warns that on-device evidence may have been altered or deleted, so logs from outside the appliance matter more than the appliance's own records.
The same report notes separate activity from late August 2026: Arctic Wolf observed high-volume credential attacks against internet-facing Fortinet VPN appliances across two waves, using organisation-specific usernames and corporate addresses rather than generic lists, which suggests prior identity enumeration.
Why it matters
A mail gateway sits at the edge and is designed to accept untrusted input from anyone. That makes a parsing flaw with root impact close to a worst case: no credentials, no user interaction, just a message. For smaller organisations the appliance is often installed once and then quietly forgotten between support renewals, so patch lag tends to be measured in months.
Root access on that device also means access to mail in transit, stored quarantine content and any credentials configured on it — an attractive foothold for onward movement, and hard to verify after the fact.
What to do
- Inventory every Secure Email Gateway instance, including virtual appliances and any left over from migrations, and upgrade to the fixed AsyncOS release. Treat this as an out-of-band change, not part of the next quarterly window.
- Run the log checks from the advisory on every cluster member, then corroborate with firewall, NetFlow and DNS records held off the device: look for unexpected outbound connections or file transfers from the gateway.
- If you find indications of compromise, assume the appliance is untrustworthy — rebuild from a clean image and rotate every credential and certificate it held.
- Separately, review VPN and remote-access authentication logs for bursts of failures against real employee usernames, and confirm MFA is enforced on those gateways.