Cisco Secure Email Gateway: Root RCE via CVE-2026-76461

CVE-2026-76461 is a critical, unauthenticated zero-day vulnerability in Cisco Secure Email Gateway's AsyncOS (CVSS 9.8) currently being exploited in the wild. The flaw originates from insufficient validation within the email parsing logic, enabling an unauthenticated attacker to execute a SQL injection. By leveraging the Postgres COPY ... TO PROGRAM primitive, the attacker achieves immediate root-level remote code execution (RCE) via a single crafted email sent to the appliance's MX record. The vulnerability grants full system compromise, allowing for the theft of LDAP credentials and the manipulation of local logs to evade detection. Immediate patching to fixed AsyncOS versions is required, as no workarounds exist.

• Vulnerability Mechanics: SQLi to Root RCE

  • Root cause is a failure to sanitize input during the parsing of incoming email headers and content.
  • The injection target is the underlying PostgreSQL database used by AsyncOS for mail processing.
  • Attackers utilize the COPY ... TO PROGRAM command to bridge the database context directly to the operating system shell.
  • The attack vector is entirely network-based via SMTP, requiring no authentication or user interaction.

• Impact and Exploitation Status

  • Actively exploited in the wild, granting attackers full administrative (root) control of the appliance.
  • Because the gateway resides in the DMZ, it serves as a high-value pivot point for lateral movement into the internal network.
  • Attackers can intercept decrypted mail and steal sensitive LDAP bind credentials and API keys.
  • Root access allows for the modification or deletion of local audit logs, masking the attacker's presence from internal auditors.

• Detection and Indicators of Compromise (IoCs)

  • Review mail_logs (IronPort text logs) specifically for the execution string COPY ... TO PROGRAM.
  • Monitor for anomalous outbound network sessions on ports other than 25, 587, or 443.
  • Identify high-volume egress traffic during idle hours to previously unseen or known malicious external IP addresses.
  • Rely on external telemetry—such as firewall logs, NetFlow, and DNS—rather than appliance logs due to potential root-level tampering.

• Remediation and Compliance

  • Immediate upgrade to AsyncOS versions 15.5.5-0141, 16.0.4-302, or 16.5.0-780 is mandatory.
  • No viable configuration workarounds or temporary mitigations are available.
  • The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
  • Federal agencies are mandated to complete patching by the September 17, 2026, deadline.