Cisco reissues fix for exploited Secure Email Gateway flaw CVE-2026-76461

Cisco reissues fix for exploited Secure Email Gateway flaw CVE-2026-76461

3 November 2026: Cisco has replaced the fix it shipped in AsyncOS release 15.5.5-014 for CVE-2026-76461, a critical SQL injection (CVSS 9.8) in the email parsing of Secure Email Gateway. An unauthenticated attacker who sends a crafted message through an affected device can run commands as root. Cisco's PSIRT says it learned of active exploitation in September 2026, and the advisory lists no workaround.

Not yet independently verified. Cisco does not say how many gateways were attacked or by whom, and we have not checked whether CISA lists CVE-2026-76461 as exploited. The advisory does not explain what changed in the reissued 15.5.5-014 fix beyond the Retro Remediation Engine check. We will update this when it can be confirmed, and remove this note.

Not the flaw from October

This is a different bug from CVE-2026-76519, the arbitrary file write in Advanced Malware Protection that we reported in an earlier item. The two share a lot: both score 9.8, both end in root on the appliance, both are exploited and both point to the 15.5.5-014 and 16.5.0-780 releases. They differ in the way in. CVE-2026-76519 needs File Reputation switched on and an old Content Scanner Tools package. CVE-2026-76461 sits in the mail parser itself, so physical and virtual gateways are affected whatever their configuration. Its advisory was first published on 14 September, a month before the other, which makes it the older of the two exploited gateway flaws.

Why the first fix was replaced

Version 1.2 of the advisory, dated 3 November, changes the fixed-releases table. Cisco says that on 31 October, because exploit code had appeared online, it released an updated version of the fix inside 15.5.5-014. Anyone who installed that release earlier cannot assume they have the new build. The check is to run retroscannerstatus at the command line and confirm that Cisco Retro Remediation Engine is at version 4.0.2 or later.

The first fixed release for each line:

• 15.5 and earlier: 15.5.5-014, with the engine check above;
• 16.0: 16.0.4-302;
• 16.5: 16.5.0-780, which needs no engine check.

Cisco strongly recommends that anyone below 16.5 moves to 16.5.0-780. Secure Email and Web Manager and Secure Web Appliance are not affected.

Looking for a break-in

The advisory's log test is a search of mail_logs for the pattern COPY followed by TO PROGRAM, on every member of a cluster; any hit may mean malicious activity. Cisco adds that root access lets an attacker hide evidence, so firewall and network logs outside the appliance should be checked for unexpected uploads to external addresses.

Clusters need particular care, because members authenticate to each other with SSH key pairs that an intruder could read. Cisco says to restore every member of a cluster that holds even one compromised appliance. For a virtual appliance, record forensics first, then deploy a new virtual machine on a fixed release, rebuild the configuration and renew credentials. Physical appliances go to Cisco's support centre with remote access enabled. Secure Email Cloud devices were all moved to 16.5.0-780, and Cisco has contacted customers where it found signs of compromise.

No more hardening advisories this year

Cisco's advance notice for 4 November lists three advisories published that day: a remote code execution flaw in UCS Central (CVE-2026-76506, high, 7.6), a cross-site scripting flaw in Unified Communications Manager (CVE-2026-76419, medium, 6.1) and an authorisation bypass in Identity Services Engine (CVE-2026-20241, medium, 5.3). The notice also says the PSIRT does not plan to publish any more security hardening advisories for the rest of calendar year 2026, with the next planned publication on 20 January 2027.

Our email security software category lists 11 products.

Sources

• Cisco PSIRT: Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX), first published 14 September, version 1.2 of 3 November, 3 November 2026
• Cisco PSIRT: Advance Notification for Publication of November 4, 2026, Security Advisories (cisco-sa-notice-I8z3n6lK), 4 November 2026