Cisco Email Gateway Flaw Under Attack

A crafted email can be enough to hand an attacker root on the device that filters an organization's mail. Cisco says that is no longer theoretical: a critical flaw in its Secure Email Gateway is being exploited in the wild, and the company has already reached out to some customers whose cloud devices showed signs of malicious activity. CISA has added the bug to its Known Exploited Vulnerabilities catalog with a near-term deadline for federal agencies.

Parsing Flaw Opens Door to Root

The vulnerability is tracked as CVE-2026-76461 and carries a CVSS score of 9.8 out of a maximum of 10.0. Cisco describes it as insufficient validation in the email parsing logic. An unauthenticated, remote attacker can exploit it to run arbitrary commands with root privileges on the underlying operating system.

The mechanism, according to Cisco, involves malicious SQL statements embedded in a crafted email message. The parsing weakness lets those statements pass through the affected device and execute, which in turn leads to command execution at the highest privilege level on the host.

"An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system."

— Cisco, in its Monday security advisory

No authentication is required, and the attack arrives through the normal function of the product: accepting and processing email. That places the flaw in the most exposed part of a mail security appliance's attack surface.

Scope of Affected Deployments

Cisco says the flaw affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration. The company notes that other products — Secure Email and Web Manager and Secure Web Appliance — are not impacted.

Because the vulnerable component processes inbound mail, an affected gateway is reachable by anyone who can send it a message. The source text indicates no configuration setting removes that exposure, which places the burden on patching rather than on hardening settings.

Cisco's advisory states that the issue affects all configurations of the gateway, not just those with optional features enabled. That broadens the set of organizations that need to check their applicable release and upgrade.

Fixed Releases and Missing Workarounds

Fixes are available for the following versions of Cisco AsyncOS for Cisco Secure Email Gateway Software Release:

• 15.5 and earlier (Fixed in 15.5.5-0141)
• 16.0 (Fixed in 16.0.4-302)
• 16.5 (Fixed in 16.5.0-780)

Cisco states there are no workarounds other than updating to the latest supported version. That leaves administrators with a single path: identify every affected gateway and move it to a fixed release.

The version list spans three release trains, which means an organization running a mix of gateway software across sites may need to track more than one target build. The company's advisory ties each fixed build to a specific train rather than a single universal update.

Cisco's Detection Guidance for Admins

Cisco says it became aware of active exploitation of this vulnerability this month. To help defenders check for signs of compromise, the company shared the following indicators of compromise:

• Review mail_logs and look for suspicious SQL statements.
• If the device is part of a cluster, review the logs of each cluster device.
• To detect potentially malicious SQL statements, it's advised to run the command: cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]
• The presence of any entry in the output may indicate malicious activity.

The guidance to check every node in a cluster matters because a compromise on one device may not be the only one. The advisory also says Cisco has directly contacted customers who own Cisco Secure Email Cloud devices on which malicious activity was detected. Cisco did not disclose the scale of the attacks.

Why Root Access Complicates Cleanup

Cisco warns that the privilege level available through this flaw changes the difficulty of post-incident review. In its own words, attackers who succeed can reach the operating system as root, and that level of access can be used to cover tracks.

"Upon successful exploitation of this vulnerability, threat actors may obtain command execution with root privileges. Because of this level of access, evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors."

— Cisco, in the same advisory

Because of that, Cisco recommends that administrators cross-check network logs and firewall logs outside of the impacted device to identify any potential anomalous activity. The company points to unexpected uploads initiated from the affected device to external IP addresses, or downloads from malicious IP addresses, as examples of what to look for.

Pulling evidence from outside the appliance matters if the appliance itself can no longer be fully trusted. A gateway whose logs may have been altered is a weaker source of truth than network and firewall records collected elsewhere.

Federal Deadline Lands September 17

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency to add CVE-2026-76461 to its Known Exploited Vulnerabilities catalog. That inclusion requires Federal Civilian Executive Branch agencies to apply the patches by September 17, 2026.

The KEV listing is a formal signal that the U.S. government treats the bug as exploited rather than merely exploitable. For federal agencies, the catalog entry converts Cisco's advisory into a binding remediation timeline. Federal civilian executive branch agencies are the specific organizations named in the requirement.

The source article reporting this is dated September 15, 2026, and Cisco describes its advisory as issued on a Monday. The federal deadline of September 17, 2026 falls two days after that reporting date.

Fortinet VPN Attacks Add to the Picture

The Cisco disclosure came days after Arctic Wolf said it detected large-scale credential attacks targeting internet-facing Fortinet VPN appliances in late August 2026. According to the source, the high-volume activity took place over two sustained waves across multiple U.S. customer environments from August 26 through August 28, 2026, generating tens of millions of authentication failures.

Security researcher Kyle Siddall described how the attempted logins were built. "The actor used organization-specific usernames, corporate email addresses, affiliate accounts, and common administrative identities, indicating access to previously collected or enumerated identity information," he said.

Siddall added that the usernames were not generic. "The attempted usernames included employee names, corporate email addresses, affiliate identities, and common administrative accounts associated with the targeted organizations. This targeted identity selection, rather than generic username spraying, indicates access to previously collected or enumerated identity information," he said.

The source also notes one observed case in which a successful Fortinet VPN authentication originating from the IP address "158.94.211[.]14" was followed by malicious activity in the affected environment. That detail links a successful login from that address to subsequent activity inside the environment.

What Administrators Should Do Next

For organizations running Cisco Secure Email Gateway, the immediate step described in the advisory is to identify the applicable AsyncOS release and update to the fixed build for that train, since Cisco lists no workaround. That means checking the software version on every gateway, including virtual instances.

Detection work runs alongside patching. Cisco's indicators direct administrators to review mail_logs for suspicious SQL statements, check each device in a cluster rather than a single node, and run the grep command it provides against the IronPort text mail logs. Any output from that command may indicate malicious activity, per the advisory.

Because root-level access can erase traces on the appliance itself, the advisory's recommendation to examine network and firewall logs outside the affected device gives defenders a second, independent record to review. Administrators are told to look for unexpected uploads from the device to external IP addresses and downloads from malicious IP addresses.

For federal agencies covered by the KEV entry, the patch deadline of September 17, 2026 sets the outer bound for remediation. For everyone else running the affected gateway, the advisory's content points to the same sequence: confirm the version, move to a fixed release, and check the logs, including those of any cluster peers.

The Broader Stakes for Defenders

Two things make this disclosure worth close attention. First, the Cisco flaw sits in an email security appliance — a device whose job is to inspect hostile input from the public internet. A parsing weakness there means the protective layer itself is reachable by the very traffic it is meant to filter, and a successful exploit yields root, the highest level of access on the host.

Second, the timing pairs an exploited appliance bug with a separate, high-volume credential campaign against internet-facing VPNs. The Fortinet activity described by Arctic Wolf used organization-specific identities rather than generic usernames, and in one observed case a successful VPN login was followed by malicious activity in the affected environment. Read together, the two items suggest that edge-facing security infrastructure — mail gateways and remote-access VPNs — is where some attackers are concentrating effort.

The cleanup implications are the part administrators may underestimate. When an attacker reaches root, indicators on the device can be removed or hidden, which is why Cisco directs defenders to logs collected outside the appliance. Organizations that rely solely on the gateway's own records could miss activity that network and firewall logs would reveal.

For federal agencies, the KEV listing removes any ambiguity: the patch deadline is September 17, 2026. For private-sector operators of Cisco Secure Email Gateway, the practical conclusion is similar — the flaw is under active exploitation, fixes exist for the listed release trains, and Cisco states there is no alternative to updating. The value of checking the provided indicators is highest before a patch is applied, while signs of prior intrusion may still be recoverable from sources the attacker could not reach.