CVE-2026-76461: SQL injection in an email gateway reaches root on the appliance

A mail parser that trusts its input

Cisco published fixes for CVE-2026-76461 in AsyncOS for the Secure Email Gateway in September 2026. The flaw is a SQL injection in the code that parses inbound mail. Cisco describes the cause as insufficient validation of user-supplied input in the email parsing path, and states that an unauthenticated remote attacker can send a crafted message to the affected device and execute arbitrary SQL statements, which in turn allows command execution as root on the underlying operating system.

The vulnerability affects both physical and virtual deployments. Fixed AsyncOS builds are 15.5.5-0141, 16.0.4-3021 and 16.5.0-780. Cisco's product security team identified exploitation in the wild before the patch was published, and CISA added the flaw to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of 17 September 2026. The CVSS score is 9.8.

Why this class of bug lands so hard on a mail gateway

The parsing of inbound mail is the product's reason to exist. A gateway accepts messages from any sender on the internet by design, so the attack path needs no account, no session and no user action. The service also has to inspect message content, which means it processes attacker-controlled data deep inside the application rather than at a network boundary.

SQL injection in that position is unusual and instructive. It suggests a component stores or queries message-derived data through a database interface, and that the value reaching a query was not parameterised. From the attacker's point of view the important consequence is the last step in Cisco's description: the database interface is not the end, and the query path can invoke functionality that reaches the operating system with the privileges the mail processing service holds. Those privileges are root.

A mail security appliance also occupies a useful position. It sees inbound and outbound message flow, it holds credentials to downstream mail systems, and it is trusted by the network as a filter rather than treated as an untrusted host.

Remediation, and what patching does not cover

Upgrade to a fixed AsyncOS build. Cisco additionally advises that because exploitation occurred before the patch, upgrading alone is not sufficient and organizations should confirm whether a device was compromised.

• Compare installed AsyncOS builds against 15.5.5-0141, 16.0.4-3021 and 16.5.0-780.
• Review message logs and content-filter logs for malformed messages that triggered errors or unusual database activity.
• Look for local accounts, scheduled tasks or configuration entries created outside change control, since root access on the appliance permits all of them.
• Rotate credentials the gateway uses to reach downstream mail infrastructure and any directory services it queries.
• Restrict management access to the appliance to an administrative network.

Where a device is suspected to be fully compromised, rebuild it and reload a configuration from before the exposure window. A root-level presence on an appliance is not reliably removed by upgrading the firmware that hosts it.

References

• Cisco security advisory for CVE-2026-76461 in AsyncOS
• CISA Known Exploited Vulnerabilities catalog, entry for CVE-2026-76461
• NVD record for CVE-2026-76461