Attackers exploit SQL vulnerability in Cisco's Secure E-Mail Gateway

Cisco has observed attacks on a security vulnerability in all variants of the Secure E-Mail Gateway. The company is providing updated software to patch the critical flaw. Admins should apply it immediately.

The US cybersecurity authority CISA also warns of the cyberattacks . Cisco explains details in its security advisory . According to this, unauthenticated attackers from the network can exploit a vulnerability when processing emails to inject malicious code and execute it with root privileges in the host’s operating system ( CVE-2026-76461 , CVSS 9.8 , Risk “ critical ”). The error is due to insufficient checking during email parsing, allowing malicious actors to send emails with malicious SQL statements that are executed when processed by vulnerable devices.

The manufacturer states that updated software is available. The problem cannot be addressed with temporary countermeasures. Cisco’s Secure E-Mail Gateways, both in their physical and virtual versions, are affected, regardless of device configuration. However, Secure E-Mail and Web Manager, and Secure Web Appliance are not vulnerable, Cisco emphasizes.

The security advisory also lists indicators of compromise (IOC) for successful attacks, which admins should use to check if their instances have already fallen victim to attackers. The upgrade to Cisco AsyncOS for Cisco Secure E-Mail Gateway Software Release 15.5.5-014, 16.0.4-3021, and 16.5.0-780 eliminates the security vulnerability, with the company strongly recommending migrating to the 16.5 development branch.

A second security advisory from Cisco announces security updates for Cisco Secure E-Mail Gateway, Secure E-Mail, and Web Manager. The developers are closing five additional security vulnerabilities, four of which they classify as “ critical ” risk (CVE-2026-76440, CVE-2026-76441, CVE-2026-76443, CVE-2026-20353; all CVSS 9.8 ). Vulnerability CVE-2026-76442 is classified as “ high ” risk with a CVSS score of 7.5. Cisco is patching the vulnerabilities with Cisco Secure E-Mail Gateway Release 15.5.5-014 and 16.5.0-780 and Secure E-Mail and Web Manager Release 15.5.5-006 and 16.5.0-429. Those using the 16.0 branches of the products should also migrate to a patched version; logically, this only leaves the 16.5 software branch.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.