Cisco Secure Email Gateway Vulnerability Now Actively Exploited

Cisco has confirmed that a critical Cisco Secure Email Gateway vulnerability tracked as CVE-2026-76461 is being actively exploited in the wild. The flaw affects AsyncOS Software for Cisco Secure Email Gateway and carries a CVSS severity score of 9.8 out of 10, nearly the highest possible rating. Cisco first described the problem in a Monday advisory. The company says the vulnerability is caused by insufficient validation in the email parsing logic. Because of that missing check, an unauthenticated attacker can send a specially crafted email message containing malicious SQL statements and then run arbitrary commands with root privileges on the underlying operating system. SQL is a language used to read and change information stored in databases, and root privileges are the highest level of administrator control on a computer. In practical terms, a successful attacker can take full control of the affected device without needing to sign in first.

Cisco says the vulnerability affects Cisco Secure Email Gateway in both physical and virtual forms, regardless of how the device is configured. The company also states that other products such as Secure Email and Web Manager and Secure Web Appliance are not affected. Fixed software is available for three Cisco AsyncOS release tracks. Customers on version 15.5 and earlier should upgrade to 15.5.5-0141. Customers on 16.0 should upgrade to 16.0.4-302. Customers on 16.5 should upgrade to 16.5.0-780. There are no workarounds other than updating to a fixed supported version. In response to the active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog, a public list of flaws that federal agencies must patch quickly because attackers are already using them. Under that listing, Federal Civilian Executive Branch agencies are required to apply the patches by September 17, 2026.

Cisco says it became aware of active exploitation this month. To help administrators detect possible abuse, Cisco lists several indicators of compromise, or IoCs. Email gateway operators should review mail_logs for suspicious SQL statements. If a device is part of a cluster, admins should review the logs on every cluster member. Cisco specifically suggests running the command cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]. If the output contains an entry, that may indicate malicious activity. Cisco also stated that it has directly contacted customers who own Cisco Secure Email Cloud devices where malicious activity was detected. The company did not disclose the scale of the attacks or how many customers were affected.

Because a successful exploit can provide root command execution, threat actors may be able to delete or hide evidence of compromise on the device itself. Cisco therefore advises administrators to cross-check network logs and firewall logs outside the impacted device. Teams should look for unexpected uploads initiated from the affected device to external IP addresses, as well as downloads from malicious IP addresses. This outside view is important because an attacker with root access can tamper with local logs and make the device appear clean.

The Cisco warning arrives shortly after Arctic Wolf reported a separate wave of large-scale credential attacks against internet-facing Fortinet VPN appliances. According to Arctic Wolf, the activity took place over two sustained waves across multiple U.S. customer environments from August 26 through August 28, 2026. The attacks produced tens of millions of authentication failures, which are failed sign-in attempts. Security researcher Kyle Siddall said the actor used organization-specific usernames, corporate email addresses, affiliate accounts, and common administrative identities. That pattern indicates the attacker had access to previously collected or enumerated identity information rather than simply guessing generic usernames. In one observed case, a successful Fortinet VPN authentication coming from IP address 158.94.211[.]14 was followed by malicious activity in the target environment. A VPN, or virtual private network, is a secure private connection used to reach company systems over the internet.

For website owners, businesses, and IT teams, the two reports highlight the same operational concern: public-facing appliances and remote access systems are being tested continuously. Unpatched Cisco Secure Email Gateways can give an outsider full control through a single crafted email, while exposed VPN logins are being hammered with previously leaked usernames and passwords. This makes timely patching, log reviews, and multi-factor authentication essential. For teams that need help with audit and patching routines for public-facing appliances, AEU-I offers security-first IT and infrastructure consulting that can support planning and verifying updates.