Cisco Secure Email Gateway flaw exploited in the wild lets a crafted email run root commands
A 9.8-rated bug in the appliance's email parsing turns an inbound message into root command execution, with no workaround other than the patch. A clear lesson in why parsers are the most dangerous code you run.
Cisco has confirmed that a critical vulnerability in its Secure Email Gateway is being exploited in the wild, according to a report by The Hacker News on 15 September 2026. The flaw, tracked as CVE-2026-76461 and rated 9.8 out of 10 on the CVSS scale, stems from insufficient validation in the appliance's email parsing logic. An unauthenticated remote attacker can exploit it by sending a crafted email message containing malicious SQL statements through an affected device. Successful exploitation allows arbitrary SQL statements to run, and from there command execution with root privileges on the underlying operating system.
The vulnerability affects Cisco Secure Email Gateway in both physical and virtual form, regardless of configuration. Cisco's Secure Email and Web Manager and its Secure Web Appliance are not affected. Fixed releases are 15.5.5-0141 for version 15.5 and earlier, 16.0.4-302 for version 16.0, and 16.5.0-780 for version 16.5. There are no workarounds; the only remedy is to update to a fixed release.
Cisco said it became aware of exploitation this month and has contacted Secure Email Cloud customers where malicious activity was detected. The scale of the attacks has not been disclosed. The company has published indicators of compromise, including suspicious SQL statements in the appliance's mail_logs, a grep pattern for "COPY.*TO PROGRAM", and unexpected uploads to external IP addresses or downloads from malicious hosts.
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-76461 to its Known Exploited Vulnerabilities catalogue and requires federal civilian agencies to patch by 17 September 2026.
Why it matters
Email gateways sit at the edge of the network and process untrusted input from anyone on the internet, all day, with no human in the loop. A bug in that parsing path is reachable simply by sending a message, which is why this class of flaw is prized by attackers and why a two-day federal patch deadline is not an overreaction. The episode also shows how quickly a vendor advisory becomes an active campaign: the gap between disclosure and exploitation is now measured in days. Security appliances themselves are a favourite target because they are trusted, privileged and rarely inspected from the inside.
Email gateways sit at the edge of the network and process untrusted input from anyone on the internet, all day, with no human in the loop.
Crafted email arrives
An attacker sends a message containing SQL fragments to the gateway; no login is needed.
Parser trusts the content
Insufficient validation in the email parsing logic lets those fragments reach a database query.
Injected SQL executes
Arbitrary SQL statements run on the appliance with the database service's privileges.
Query output piped to a program
Cisco's indicators point to COPY ... TO PROGRAM statements, which hand query output to the operating system.
Root command execution
Commands run as root on the underlying OS; the fix is a patched release, there is no workaround.
What you can learn from this
- Parsers are attack surface. An email gateway has to decode MIME structures, headers, character encodings and attachments, and it does this for every message from anyone. Any code that turns untrusted bytes into structured data is a parser, and parsers are where memory bugs and injection bugs live, because they handle the most varied input with the least context. The safe posture is to assume every parser will eventually be broken, minimise what runs with privilege after the parse, and instrument the parse step so you can see when something unusual arrives.
- SQL injection is not only a web problem. The advisory describes malicious SQL statements arriving inside an email. That happens when a component builds a database query by concatenating data it extracted from a message instead of passing it as a bound parameter. Parameterised queries work because the database receives the query structure and the data separately, so data can never change the shape of the command. The same discipline applies to any query language, including LDAP filters and shell commands.
- From SQL to root is an escalation path, not one bug. The pattern Cisco published, COPY followed by TO PROGRAM, refers to a database feature that pipes query output into an operating system program. Databases ship with such features for administrators, and they are harmless until a query can be injected and the database runs as a privileged user. Two failures stack here: the injection, and the excessive privilege of the database service. Least privilege exists precisely to stop the second failure from turning a data-layer bug into full system compromise.
- "No workaround" changes the response. Many advisories offer a mitigation, such as disabling a feature or blocking a port, that buys time. Here the vulnerable code is the core function of the product, receiving mail, so the only choice is to patch or take the device offline. That is why the KEV listing carries a short deadline. It also explains why appliance owners should keep a tested upgrade procedure ready in advance, because there is no time to write one during an incident.
- Vendor-detected compromise is a signal about your logging. Cisco contacted cloud customers where it saw malicious activity; on-premises customers have to look for it themselves in mail_logs. If logs from your edge devices are not shipped to a central store you can search, you cannot answer the first question in any incident, which is whether you were hit. Centralised logging is the control that turns an advisory into a checkable question rather than a guess.
We teach this
How to use this in practice
- Inventory your edge appliances and their versions today. List every device that accepts connections from the internet: mail gateways, VPN concentrators, web application firewalls, load balancers. Record the product, the version and who owns the upgrade. Done looks like a sheet or a ticket per device where you can answer, within a minute, whether a given CVE applies to you. If a Cisco Secure Email Gateway is on that list, compare its version with 15.5.5-0141, 16.0.4-302 or 16.5.0-780 and raise the upgrade with whoever owns it.
- Practise a KEV triage. Open CISA's Known Exploited Vulnerabilities catalogue, pick the five most recent entries, and for each one write two lines: does it apply to anything we run, and what is the deadline. Doing this weekly takes fifteen minutes and builds the habit that matters most in vulnerability management, which is separating the exploited few from the theoretical many. Done looks like a short note you could hand to a colleague.
- Find one string-built query and fix it. In any codebase you have access to, search for query construction that uses string concatenation or formatting with user-supplied values, then rewrite one instance to use bound parameters. Test that the original input still works and that an input containing a quote character no longer changes the query. Done looks like a diff you understand well enough to explain why the new version is immune to injection.
- Run the published check on real logs, or build a lab that can. If you administer a mail appliance, run the COPY.*TO PROGRAM search against mail_logs in coordination with your security team and record the result either way. If you do not, forward syslog from a Linux virtual machine to a second machine and practise searching it. Done looks like being able to answer "did this pattern appear in the last 30 days" from one place rather than by logging into each box in turn.
Sources
- Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution — The Hacker News
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report