The attack surface here is not a login page or an API endpoint. It is an email your gateway is designed to accept from anyone.
An SQL injection bug inside your mail parser
CVE-2026-76461 sits in the email-parsing component of Cisco AsyncOS, the software that runs Cisco’s Secure Email Gateway appliances. Cisco classifies it as CWE-89, improper neutralisation of special elements used in an SQL command, and the practical effect is that a specially crafted email containing malicious SQL statements, sent through an affected gateway with no authentication and no user interaction, can result in arbitrary command execution with root privileges on the underlying operating system. Cisco rated it 9.8 out of 10 and confirmed its Product Security Incident Response Team became aware of active exploitation before the September 14 advisory went out.
Root on the appliance that reads every email first
A Secure Email Gateway sits in front of an organisation’s mail flow specifically so it can inspect every message before it reaches an inbox. That makes root access to the appliance itself unusually valuable to an attacker: beyond whatever data or credentials live on the box, a compromised gateway is a vantage point that already sees every inbound and outbound message, making it a natural platform for further phishing, credential harvesting, or quietly redirecting mail flow. There is no workaround Cisco has published; the only fix is the update.
The fix and the clock
Cisco has released AsyncOS 15.5.5-014 for the 15.5 branch and earlier, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5, with the company specifically recommending migration to 16.5.0-780 rather than staying on an older maintained branch. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 17, which as of this post is tomorrow. A same-week KEV deadline on an internet-facing mail appliance is not a scheduling suggestion, it is a signal that opportunistic scanning is already underway.
What to do before the deadline passes
Check your AsyncOS version against the patched builds above and apply the update now rather than in your next maintenance window; there is no mitigating configuration change that substitutes for it. Once patched, review gateway logs for the period before the update for anything resembling malformed or unusually structured inbound messages, since a quiet compromise here can predate detection by days.
If your organisation runs Cisco Secure Email Gateway, or any internet-facing mail infrastructure, and you want confirmation that this patch actually landed everywhere it needs to, contact Excello Digital. We help European organisations verify and harden exactly this kind of mail infrastructure before a KEV deadline becomes an incident report.