CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Overview

On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance.

Cisco Secure Email Gateway, formerly known as IronPort Email Security Appliance, is an enterprise email security product that inspects inbound and outbound email for threats including phishing, malware, spam, and business email compromise. Because affected gateways process externally delivered email as part of their normal operation, exploitation does not require access to an administrative interface or authentication. An attacker can reportedly trigger the vulnerability by sending a specially crafted email through a vulnerable gateway.

CVE-2026-76461 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on the same day as the vendor disclosed the vulnerability, indicating that CVE-2026-76461 was exploited as a zero-day prior to disclosure. Cisco noted that their PSIRT became aware of active exploitation in September 2026. At the time of publication, there is no public proof-of-concept exploit code available, and no attribution for the current threat actor activity.

On October 14, 2026, Cisco published a critical security advisory for CVE-2026-76519, an arbitrary file write vulnerability affecting physical and virtual Cisco Secure Email Gateway appliances. The vulnerability is a relative path traversal (CWE-23) and has a CVSSv3.1 score of 9.8. An unauthenticated, remote attacker can exploit the vulnerability by sending a crafted email attachment through an affected appliance, resulting in arbitrary command execution with root privileges on the underlying operating system. While the vendor advisory for CVE-2026-76519 was published a month after that of CVE-2026-76461, the fixed versions for both vulnerabilities remain the same, therefore customers who have updated to a fixed version for CVE-2026-76461 are expected to also be remediated against CVE-2026-76519.

According to Cisco, CVE-2026-76519 is being actively exploited in the wild; Cisco PSIRT became aware of the activity in October 2026. Cisco also identified indicators of possible compromise on Cisco Secure Email Cloud devices and has contacted affected customers directly. CVE-2026-76519 was added to CISA's Known Exploited Vulnerabilities catalog on October 14, with a remediation due date of October 17, 2026.

Mitigation guidance

Organizations running Cisco Secure Email Gateway should prioritize upgrading to a vendor-supplied fixed version on an emergency basis, outside of normal patching cycles.

Given the reported active exploitation and the ability to achieve unauthenticated root-level command execution through malicious email processing, organizations should prioritize patching rather than relying solely on network controls or monitoring. Cisco also strongly recommends that customers migrate to the latest product version, 16.5.0-780.

For the latest remediation guidance, see the vendor advisory.

Indicators of compromise

The following indicators of compromise for CVE-2026-76461 were reported within the Cisco security advisory.

To confirm any attempted exploitation of this vulnerability, review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, review the logs of each cluster device. The following is a non-exhaustive example of how a malicious SQL statement could be detected in the logs:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

The presence of any entry in the output may indicate malicious activity.

For CVE-2026-76519  Cisco recommends searching system_logs on each appliance in a cluster for compromise indicators:

esa-appliance> grep "System Security" system_logs

Cisco warns that successful exploitation gives attackers enough access to remove or hide evidence; the absence of an on-device indicator therefore does not conclusively rule out compromise. Defenders should cross-check network and firewall logs collected outside the appliance for suspicious activity, including unexpected uploads to external IP addresses or downloads from malicious IP addresses.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-76461 with a vulnerability check expected to be available in the September 16 content release.

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-76519 with a vulnerability check expected to be available in the October 16 content release.

Updates

• September 15, 2026: Initial publication.

• October 15,2026: Updated Overview, Indicator of compromise and, Customer sections for newly published Cisco CVE-2026-76519 vulnerability.