Cisco Secure Email Gateway is a pre-auth root shell. Closing the admin port does not close the mail path.

CVE-2026-76461, CVSS 9.8, CISA KEV due 17 September with forensic triage. Cisco PSIRT confirmed September exploitation. The payload is a crafted email. There is no workaround.

RWP Ventures · 2026-09-15 · event 2026-09-14 · 14 min read · priority 8.8

CISA added the CVE to KEV the same day. Catalog version 2026.09.14. Federal due date 17 September. Forensic-triage flag: Yes. Ransomware-use flag: Unknown. This is the second Secure Email Gateway row in KEV after CVE-2025-20393. Do not collapse them.

The operational sentence is the vector. This is not the web management interface. The exploit path is mail the gateway already has to accept. Taking the admin portal off the internet, wrapping it in SAML, or putting it behind a jump box does not close CVE-2026-76461. Cloud tenants are already on 16.5.0-780. On-prem still has to hunt mail_logs for COPY.*TO PROGRAM, because root on the box can delete the same logs you planned to use as proof you were clean.

What happened

Cisco’s 14 September advisory is short because the failure is in the parser, not in a misconfiguration. An attacker does not need a session, a credential, or a user click. They send a message the gateway is designed to ingest. AsyncOS email-parsing logic does not adequately neutralize SQL. The injected statements run. Cisco’s own wording then jumps the gap that usually takes a second bug: SQL execution leads to OS command execution with root. Scope is Unchanged. Impact is High on confidentiality, integrity, and availability of the appliance.

Cisco confirmed Secure Email and Web Manager and Secure Web Appliance are not affected by 76461. That matters because a sibling hardening advisory, cisco-sa-hardening-esa-dfCrfXkm, published the same hour, does cover both SEG and SEWM. Do not patch the wrong product against the wrong CVE and declare the mail path closed.

Fixed AsyncOS for SEG:

Cisco strongly recommends migrating to 16.5.0-780. Secondary write-ups concatenated the footnote marker into version strings (15.5.5-0141, 16.0.4-3021). Those are not the builds. Use the table in cisco-sa-esa-inj-2bLVGmhX.

Cisco Secure Email Cloud: every cloud SEG is already on 16.5.0-780. Cisco says it completed a threat-intelligence review of cloud devices, contacted customers where indicators of possible compromise were identified, and is in remediation and recovery with those tenants. Cloud “already upgraded” is not a clean bill for a tenant Cisco already called.

CISA’s 14 September KEV alert added one CVE. That is the overnight increment from catalog 2026.09.11, which still sat on ScreenConnect, Artifactory, and GitLab when [yesterday’s Daily Top](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/) ran. JPCERT/CC issued AT-2026-0027 on 15 September and reminded Japanese operators that CVE-2025-20393 produced confirmed domestic SEG compromises. The Canadian Centre for Cyber Security published AV26-921 the same day as the Cisco advisory, restating exploitation and the KEV listing. BleepingComputer, SecurityWeek, and heise carried English coverage into 15 September.

Why it matters

Three facts should not be collapsed.

First: PR:N on a mail gateway is not a web-UI story. FMC [CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) was unauthenticated root on the management plane if you could reach the web interface. Operators could shrink that surface. SEG’s job is to accept unauthenticated SMTP from the world. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the product’s intended input path. Hardening the admin portal is still good practice. It is not this patch.

Second: root on the email gateway is mail, identity, and often the quarantine. The box that decrypted TLS, ran DLP, held spam quarantines, and brokered LDAP lookups is now an unauthenticated OS shell. Credential and cryptographic-material rotation after a suspected hit is not optional theater. Cisco’s own recovery language for virtual appliances is: preserve forensics, deploy a new VM on a fixed release, rebuild the configuration, renew credentials and any cryptographic materials. For physical appliances, call TAC; do not “upgrade in place and hope.”

Third: KEV forensic triage Yes means the patch does not prove the box was clean. BOD 26-04’s three-day clock for FCEB ends 17 September. Private-sector mail operators are not FCEB. They run the same AsyncOS. Cisco’s detection example is grep -i "COPY.*TO PROGRAM" against IronPort text mail_logs, on every member of a cluster. Presence of a match may indicate malicious activity. Absence of a match does not prove absence of exploitation: Cisco states, in the same paragraph, that root can remove or hide local evidence. Cross-check network and firewall logs off-box for unexpected uploads from the appliance and downloads from untrusted addresses. Cloud admins without CLI cannot run that grep themselves.

We have no confirmed OT, ICS, or physical-process impact. A Secure Email Gateway in front of a plant, a water utility, or a hospital is still an IT compromise of the mail perimeter at an industrial or clinical organization. Do not write a process event.

Who / what is affected

Technical context

RWP is not reproducing SQL payloads, SMTP content, or a parser trigger. Cisco’s public description is enough for a defender: email-parsing logic failed to neutralize SQL (CWE-89); a crafted message through an affected device is the exploit; SQL execution is the bridge to root commands. The published hunting string — COPY combined with TO PROGRAM in mail_logs — is a database-side command-execution primitive showing up in IronPort text logs. Treat it as a detection signature Cisco chose to print, not as a recipe.

The sibling hardening advisory groups other internally discovered issues by CWE and assigned one CVE per class: path traversal (CVE-2026-76440, 9.8), improper access control (CVE-2026-76441, 9.8), resource-lifetime control (CVE-2026-20353, 9.8), improper neutralization (CVE-2026-76443, 9.8), and improper validation of specified quantity (CVE-2026-76442, 7.5). Cisco’s footnote on 76443: one vulnerability in that class is known exploited, and the pointer is the 76461 advisory. Do not inventory 76443 as a second in-the-wild bug. Do inventory SEWM against the hardening builds (15.5.5-006, 16.5.0-429; 16.0 migrate), because SEWM is in that advisory and not in 76461.

Source distinction, because it changes how you read “internally found.” The hardening batch was found during internal testing, including frontier AI models. 76461 was found during resolution of a TAC case. That is a customer-facing incident that produced a CVE, not a lab finding that later grew a KEV row.

ATT&CK mapping for what is stated:

• Initial access: exploit public-facing application on the mail gateway (T1190). This is not user-click phishing.
• Execution: command execution on the appliance OS as root (T1059), reached through SQL injection (T1190 / CWE-89).
• Defense evasion, assessed: indicator removal is available to a root occupant (T1070). Cisco said so. We do not have a published wiper.
• Follow-on that is not claimed: named C2, ransomware, lateral movement playbook, OT logic change.

Threat / exploitation status

High confidence on: CVE identifier, CVSS vector, product scope (SEG in, SEWM/SWA out), fixed builds, absence of workarounds, KEV dates and forensic-triage flag, TAC-case origin, cloud already upgraded, Cisco’s COPY.*TO PROGRAM hunting example. Moderate confidence that unpatched on-prem and leftover 16.0 trains are the remaining exposed set (fixed releases exist; we have no install-base census). Low confidence on actor, victim count, and whether local mail_logs will still be intact on a box that already went to root.

What defenders should do

1. Inventory every Secure Email Gateway you actually run — physical, virtual, clustered, and Cisco Secure Email Cloud. Record AsyncOS train and build. Include the MX hosts that receive from the internet and any internal SEG that still parses mail. SEWM is a different advisory. Do not skip it, and do not use it as a substitute for the SEG build.

1. Hunt before you close the ticket. Forensic triage is Yes. On every cluster member: IronPort text mail_logs for COPY / TO PROGRAM (Cisco’s example: grep -i "COPY.*TO PROGRAM"). Off-box firewall and network logs for unexpected egress from the appliance and unexpected ingress from untrusted addresses. Cloud tenants without CLI: you cannot run that grep; ask Cisco whether you were in the contacted set. Preserve logs before rebuild. Deploying a new virtual instance destroys the disk you needed.

1. Patch. On-prem SEG: 15.5.5-014, 16.0.4-302, or 16.5.0-780. Cisco’s recommendation is 16.5.0-780. If you remain on 16.0, 16.0.4-302 closes 76461 only; the hardening advisory tells 16.0 customers to migrate. Upgrade via System Administration → System Upgrade, or CLI upgrade / DOWNLOADINSTALL, then reboot. Out-of-maintenance licenses do not get a free pass — restore coverage or isolate the parser from untrusted mail.

1. If exploitation is suspected: Virtual: maintain forensics, stand up a new VM on a fixed release, rebuild configuration, renew credentials and cryptographic materials. Physical: contact Cisco TAC and enable the remote access TAC needs; do not treat an in-place upgrade as eradication. Cloud: if Cisco contacted you, rotate credentials and crypto on the appliance as they directed, and restrict management access.

1. Do not confuse this with CVE-2025-20393. That was the late-2025 AsyncOS zero-day, already KEV’d, already patched, already a JPCERT domestic-incident footnote. Hunting 20393 playbooks will not find 76461 SQL in mail_logs. Hunt the signature Cisco printed for this CVE.

1. Sequence the rest of the KEV clock. [ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/) was due 14 September — host clients, not the server. [GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/) shared that due date. [Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) was due 12 September. Artifactory CVE-2026-42016 / 42018 due 25 September, triage No. [Check Point CVE-2026-85102 / 85103](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/) are still not on KEV as of 2026.09.14. They remain unauthenticated VPN RCE with an NCSC-NL imminent-exploitation warning. They are not today’s mail-parser root.

This is not an exploitation guide. Use Cisco’s advisory and the off-box logs.

RWP assessment

Score 8.8. Unauthenticated root on the appliance that must accept internet mail, confirmed exploited the same day as disclosure, KEV’d with a three-day BOD 26-04 clock and forensic triage, no workaround — that is the first material development after [yesterday’s ScreenConnect due-date assessment](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/). RWP had not published 76461. The advisory dropped at 16:00 GMT on 14 September, after that Daily Top had already shipped.

It does not outrank [FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) on evidence quality. Talos published three post-compromise clusters on FMC, including Sandworm-overlap Cyclops Blink and Qilin. 76461 has vendor confirmation, a TAC-case origin, and a KEV row. It does not yet have a named crew or a public post-compromise playbook. The vector is worse than FMC in one respect: you cannot take MX off the internet. That is why this is today’s story and not a footnote on last week’s Cisco.

It outranks Check Point 85102/85103 English recycles. That was 13 September. Still no KEV row in 2026.09.14. Still no confirmed exploitation. NCSC-NL’s “soon” has not become CISA’s “now.”

It outranks Artifactory 42016/42018 (due 25 September, triage No) and ScreenConnect leftovers. 84869’s federal clock expired yesterday. Stale host clients remain a problem. They are not a new CVE.

It outranks the hardening-train CVEs as a standalone Daily Top. They share the 14 September patch window. Cisco explicitly scoped in-the-wild to the SQLi advisory. Patch them on the same upgrade. Do not headline them.

Sunday-into-Monday KEV has moved. Catalog is 2026.09.14. One new row. This is it.

What we are watching

• Whether Cisco, CISA, or a national CERT publishes a victim count, an actor name, or a ransomware-use flip on the KEV row.
• Whether on-prem 16.0 customers stop at 16.0.4-302 or actually migrate to 16.5.0-780.
• Cloud tenants Cisco already contacted: rotation of credentials and crypto, not just the build string.
• Cluster members whose mail_logs were wiped after root.
• Whether CISA lists Check Point 85102 / 85103.
• Artifactory 42016 / 42018 through 25 September.
• Any attempt to treat a SEG compromise at an industrial mail domain as an OT event without process evidence.

Sources

• Cisco — Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX, 14 September 2026)
• Cisco — SEG and SEWM Security Hardening Release, September 2026 (cisco-sa-hardening-esa-dfCrfXkm)
• CISA — Adds One Known Exploited Vulnerability to Catalog (14 September 2026)
• CISA Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04
• NVD — CVE-2026-76461
• CVE.org — CVE-2026-76461
• Canadian Centre for Cyber Security — AV26-921 (14 September 2026)
• JPCERT/CC — AT-2026-0027 (15 September 2026)
• BleepingComputer — Cisco patches Secure Email Gateway zero-day exploited in attacks (15 September 2026)
• SecurityWeek — Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation (15 September 2026)
• heise — Attackers exploit SQL vulnerability in Cisco’s Secure E-Mail Gateway (15 September 2026)
• [RWP Daily Top, 14 September 2026 — ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/)
• [RWP Daily Top, 13 September 2026 — Check Point CVE-2026-85102 / 85103](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/)
• [RWP Daily Top, 12 September 2026 — GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)