One Email, Root Access: Cisco's Mail Gateway Zero-Day Is Under Attack
One Email, Root Access: Cisco’s Mail Gateway Zero-Day Is Under Attack
Section titled “One Email, Root Access: Cisco’s Mail Gateway Zero-Day Is Under Attack”The Cisco Secure Email Gateway exists to keep malicious email out. This week it became a way in. An unauthenticated attacker sends one crafted message and gets root on the appliance (The Register, 2026). Cisco confirmed active exploitation on September 14 (Rapid7, 2026). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026). If you run this appliance, this is the story to act on now.
The flaw: SQL injection in the mail path
Section titled “The flaw: SQL injection in the mail path”The vulnerability is CVE-2026-76461. It is a SQL injection flaw in the email parsing logic of AsyncOS, the software that runs Secure Email Gateway appliances (CyCognito, 2026). The parsing logic does not validate message content before it reaches a database query (CyCognito, 2026). An attacker sends a crafted email carrying SQL statements (BleepingComputer, 2026). The statements execute when the appliance processes the message, and they run commands with root privileges on the underlying operating system (BleepingComputer, 2026).
The advisory carries a CVSS base score of 9.8 out of 10 (Rapid7, 2026). Exploitation needs no credentials and no user interaction (CyCognito, 2026). The attacker does not need access to the management interface (Rapid7, 2026). Sending mail to the gateway is enough.
Why an email gateway is the worst place for this bug
Section titled “Why an email gateway is the worst place for this bug”The gateway’s normal job is to process externally delivered email (Rapid7, 2026). That job is the attack surface. There is no “do not expose the admin panel” mitigation, because the vulnerable code path runs on every inbound message. Locking down the device does not reduce exposure.
The bug affects physical and virtual appliances regardless of their configuration (BleepingComputer, 2026). Cisco states there is no workaround (Cisco, 2026). Patching is the only fix (The Register, 2026).
AsyncOS versions 16.5, 16.0, and 15.5 and earlier are affected on physical and virtual appliances (Help Net Security, 2026). The fixed releases are listed below (Cisco, 2026).
| Release train | First fixed version |
|---|---|
| 15.5 | 15.5.5-014 |
| 16.0 | 16.0.4-302 |
| 16.5 | 16.5.0-780 |
Exploitation: confirmed, ongoing, zero-day
Section titled “Exploitation: confirmed, ongoing, zero-day”Cisco’s Product Security Incident Response Team became aware of active exploitation in September 2026 (BleepingComputer, 2026). Cisco published the advisory on September 14, 2026 (Rapid7, 2026). CISA added the CVE to its catalog the same day, which points to zero-day exploitation before public disclosure (Rapid7, 2026). The catalog addition orders US federal agencies to remediate the flaw (Security Affairs, 2026).
Cisco found the bug while resolving a Technical Assistance Center support case (The Register, 2026). The vendor has not named the attackers, the attack duration, or the number of compromised organizations (The Register, 2026).
The cloud-delivered product line was hit too. Cisco directly contacted customers who own Secure Email Cloud devices where malicious activity was detected (Help Net Security, 2026).
Cisco shared indicators of compromise. Look for suspicious SQL statements in each cluster device’s mail_logs. Cross-check network and firewall logs for uploads and downloads to external or malicious IP addresses, because attackers may remove evidence of exploitation (BleepingComputer, 2026). Shadowserver currently tracks more than 400 public-facing Secure Email Gateway appliances (BleepingComputer, 2026).
What to do today
Section titled “What to do today”-
Patch outside the normal cycle. Confirm the AsyncOS version on every appliance. Upgrade to 15.5.5-014, 16.0.4-302, or 16.5.0-780 (Cisco, 2026). There is no workaround (Cisco, 2026).
-
Hunt before you wipe the evidence. Grep
mail_logsfor SQL fragments embedded in message bodies. Compare firewall and proxy logs for unexpected outbound connections from the appliance (BleepingComputer, 2026). Attackers can remove traces, so collect the logs first. -
Treat email infrastructure as a hostile-input product. This is the second AsyncOS root-RCE zero-day in a year. CVE-2025-20393 carried a CVSS score of 10.0 and was exploited by the China-linked group UAT-9686 (SecurityWeek, 2026). Email gateways must process untrusted input by design. Give them the same patch discipline you give routers and identity providers.
The takeaway
Section titled “The takeaway”A security product that scans hostile mail cannot be secured by hiding it. The AsyncOS mail path processes attacker-controlled content on every message, and this path now hands root to whoever sends the right email. Check the version, patch, and sweep the logs. Attackers are already doing the same math (SOC Prime, 2026).