AsyncOS
Cisco security operating system for its email and web security appliances.
An SQL injection in AsyncOS email parsing, CVE-2026-76461, reached CISA's exploited list on 14 September 2026, letting senders with no login gain root on Cisco's email gateways through software that traces back to the 2007 IronPort purchase.
Last refreshed: 12 October 2026
What is the old IronPort code inside Cisco's email gateway?
Timeline for AsyncOS
Mentioned in: Cisco reaches 100 entries on CISA's list
Cybersecurity: Threats and DefencesBackground
AsyncOS is the operating system on Cisco's email and web security appliances, including Secure Email Gateway. Cisco took the platform over when it bought IronPort Systems in 2007.
CISA listed CVE-2026-76461, an AsyncOS email-parsing flaw, as exploited on 14 September 2026, one of four Cisco listings that month. Cisco's advisory, Cisco-sa-ESA-inj-2bLVGmhX, says customers must install fixed software because no workaround exists. It excludes Secure Email and Web Manager and Secure Web Appliance from the affected products.
The appliances AsyncOS runs inspect traffic on behalf of whole organisations, and Cisco has warned that an attacker holding root on one of them can hide the evidence of the intrusion on the device itself.
Its mail parser runs attacker commands
The weakness sits in the code AsyncOS uses to parse incoming messages. According to Cisco, an unauthenticated sender only has to embed SQL statements in an email to execute commands with root privileges on a Secure Email Gateway. CISA added the flaw to its exploited catalogue on 14 September 2026 with a three-day federal Deadline.
For AsyncOS the September listing exposed how FAR back the code reaches. Cisco inherited the platform from IronPort almost two decades earlier, and the parsing logic now under attack runs on appliances that inspect mail before any employee sees it. Cisco offered no workaround, leaving a fixed AsyncOS release as the only remedy.