CVE-2026-76461

What it is. Cisco says the flaw "is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system." No login and no user click are needed.

What's affected. Cisco: "This vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration." Cisco confirms Secure Email and Web Manager and Secure Web Appliance are not vulnerable. Cisco says it "has already upgraded all Cisco Secure Email Cloud devices to Release 16.5.0-780."

• 15.5 and earlier: 15.5.5-014, with Cisco Retro Remediation Engine 4.0.2 or later
• 16.0: 16.0.4-302
• 16.5: 16.5.0-780

Cisco "strongly recommends that customers who are running releases earlier than Release 16.5 migrate to Release 16.5.0-780." Cisco says "There are no workarounds that address this vulnerability."

1. Check the AsyncOS release on every gateway, including each cluster member, against the list above.
2. On 15.5.5-014, run retroscannerstatus. Cisco says to "verify that Cisco Retro Remediation Engine is running Version 4.0.2 or later." An older engine means the October 31 fix isn't installed. Cisco says 16.5.0-780 is fixed "regardless of the version of Cisco Retro Remediation Engine."
3. Check whether it accepts mail from outside. If the gateway is your MX or sits behind it, any outside sender can deliver the crafted message. That's its normal job, so assume yes unless you confirm otherwise. A gateway that relays only internal mail is still reachable from any internal host that can send it a message.
4. Check for signs of earlier exploitation on every device before treating it as clean, using Cisco's check below.

Not the same as CVE-2026-76418. That is a separate Cisco Secure Firewall ASA and FTD denial-of-service bug with its own advisory and fixes.

Cisco says there are no workarounds and "considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available." These come from Cisco's advisory and reduce exposure without removing the bug.

• Delivery. "Prevent access from the internet to the appliance. If internet access to the appliance is required, restrict appliance access to only known, trusted hosts." This only helps for gateways that don't have to accept internet mail. On an MX gateway the attack arrives on the port it must keep open, so this mostly protects management interfaces.
• Delivery. Place the gateway behind a filtering device and "separate mail and management functionality onto individual network interfaces." This only helps if the management interface is unreachable from the mail-facing network; it does not stop a crafted email.
• Blast radius. "Regularly monitor log traffic for any unexpected traffic to or from appliances. Logging should be sent to an external server, if possible." This only helps if logs leave the device before an attacker with root can change them.
• Blast radius, clusters. Cisco warns that on a compromised appliance "private SSH keys used for this communication could be accessed" and may let an attacker "compromise other cluster members," and "strongly recommends restoring to a secure configuration each member of a cluster that contains at least one compromised appliance." This only helps if every member is rebuilt.

The upgrade is the only fix.

Cisco: "To confirm any attempted exploitation of this vulnerability, review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, review the logs of each cluster device." Cisco's example check, which it calls non-exhaustive, is grep -i "COPY.*TO PROGRAM" against the mail_logs, and "The presence of any entry in the output may indicate malicious activity."

Because attackers get root, Cisco says evidence "may be removed or hidden," and "strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device," including "unexpected uploads that were initiated from the affected device to external IP addresses." The advisory lists no IP addresses or file hashes.

If you patched late. Upgrading does not undo a compromise. For physical appliances, Cisco says to contact Cisco TAC. For virtual appliances, Cisco says to "Maintain forensics information," deploy a new virtual machine on a fixed release, rebuild the configuration, and "Renew credentials and any cryptographic materials that are installed on the appliance." Restore every member of any cluster with a compromised appliance.

Am I exposed to CVE-2026-76461?

Yes, if a Cisco Secure Email Gateway runs a release below 15.5.5-014, 16.0.4-302 or 16.5.0-780, or 15.5.5-014 without Retro Remediation Engine 4.0.2 or later, and it receives mail from senders you don't control. Configuration doesn't matter, per Cisco.

Is CVE-2026-76461 being exploited?

Yes. Cisco became aware of active exploitation in September 2026, and CISA added it to KEV on September 14 with a September 17 due date.

I installed 15.5.5-014 in September. Am I covered?

Not necessarily. Cisco reissued the 15.5.5-014 fix on October 31. Run retroscannerstatus and confirm Retro Remediation Engine 4.0.2 or later, or move to 16.5.0-780.

Is there a workaround?

No. Cisco says there are no workarounds that address this vulnerability.

Is this related to CVE-2026-76418?

No. That is a separate Cisco ASA and FTD firewall bug. Cisco firewall shops often run Cisco email gateways too, so check both.

Nov 6, 2026. First published, covering Cisco's November 3 update (v1.2) to the 15.5.5-014 fix. On CISA KEV since September 14.

• Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX (v1.2, Nov 3, 2026)
• CISA Known Exploited Vulnerabilities catalog (added Sep 14, 2026)
• NIST NVD: CVE-2026-76461 (Cisco's CNA record; checked Nov 6)