Measuring Internet-Exposed Email Security Gateways With ZoomEye

CVE-2026-76461 in Cisco Secure Email Gateway is unusual because the trigger is not a management interface. An attacker sends a crafted email, and the device's mail-parsing logic executes injected SQL that reaches root. Cisco states there is no workaround, and CISA added the flaw to the KEV catalog on September 14, 2026 with a federal deadline of September 17.

Because the attack arrives through mail rather than a web port, conventional exposure scanning does not capture the risk directly. ZoomEye can still help with the adjacent question: how many email security gateways and related mail infrastructure components are visible on the internet, and what does that population look like?

Why the usual exposure logic does not apply

For most edge vulnerabilities, internet reachability to the vulnerable service is the precondition. That is not true here. Cisco's advisory notes that the flaw is independent of device configuration, and the trigger is the act of processing an inbound message. A gateway that only accepts mail from an upstream relay is still in the attack path.

What exposure measurement can do is identify the deployed population and its management surfaces. That is useful for inventory and for understanding how much of the internet runs this class of appliance.

ZoomEye measurements

ZoomEye queries run on September 19, 2026 returned the following counts. Each is the number of matching records in the index at query time.

Query	Matching records
app="Cisco Secure Email Gateway"	1,781
app="IronPort"	37,138
app="Cisco Email Security"	0

The gap between the first two rows is instructive. app="Cisco Secure Email Gateway" matches devices whose fingerprint carries that exact product string. app="IronPort" matches a much larger set, because IronPort is the historical brand name for the same product family and appears in banners, certificates, and management interfaces across multiple generations.

The zero result for app="Cisco Email Security" is equally informative. A zero count does not mean no such devices exist. It means the index holds no records matching that exact fingerprint string. Query wording determines what a count represents.

What these numbers support

The counts support three conclusions and no more.

First, the fingerprint strings for this product family vary, so a single query understates the population. Analysts comparing counts across vendors should confirm which banner or certificate field each query matches.

Second, the absolute numbers are modest compared with general web infrastructure. This is a specialized appliance category, not a commodity service.

Third, none of these queries determines whether a device is vulnerable. The counts do not reveal the AsyncOS version, and version is what matters here. Fixed releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780.

Applying this to your own estate

For an organization that runs Secure Email Gateway, the useful application of exposure data is inventory confirmation rather than risk scoring. The steps are:

• Identify every gateway instance, including virtual appliances. Cisco states both physical and virtual deployments are affected regardless of configuration.
• Confirm the AsyncOS version on each instance against the fixed releases, and upgrade to 16.5.0-780 where possible, which is what Cisco recommends.
• Because the flaw yields root, treat the patch as a forensic checkpoint. Search mail_logs on each cluster member for anomalous SQL patterns, starting with COPY.*TO PROGRAM.
• Cross-check traffic and firewall logs collected outside the gateway, since root access allows an attacker to remove local evidence.

Limitations

All counts were collected on September 19, 2026 through ZoomEye and reflect the index at that time. They are population measurements, not vulnerability determinations, and no version-level analysis was performed. The zero result for one query reflects the absence of matching fingerprint records, not the absence of deployed devices. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected by CVE-2026-76461 and were not separately measured.

References

• Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX for CVE-2026-76461.
• CISA Known Exploited Vulnerabilities Catalog, CVE-2026-76461.
• Alibaba Cloud Vulnerability Database, AVD-2026-76461.
• ZoomEye query results collected September 19, 2026.