Cisco Secure Email Gateway
Cisco's email security appliance line, running AsyncOS.
CISA listed Cisco Secure Email Gateway flaw CVE-2026-76461 as exploited on 14 September 2026 with a three-day federal Deadline, one of four Cisco security products added in a run that took the company to 100 catalogue entries.
Last refreshed: 12 October 2026
Can one crafted email take over Cisco's email gateway?
Timeline for Cisco Secure Email Gateway
Named as Secure Email Gateway
Cybersecurity: Threats and Defences: Mentioned in: Cisco reaches 100 entries on CISA's listBackground
Cisco Secure Email Gateway is Cisco's appliance for filtering an organisation's mail, sold as physical hardware or as a virtual machine. It runs AsyncOS, the operating system Cisco acquired with IronPort in 2007, and Cisco also offers the service in hosted form as Secure Email Cloud.
The product entered CISA's Known Exploited Vulnerabilities catalogue on 14 September 2026 through CVE-2026-76461, which Cisco advisory Cisco-sa-ESA-inj-2bLVGmhX describes as SQL injection leading to root command execution. Cisco's advisory lists Secure Email and Web Manager as unaffected. The listing was one of four Cisco entries in September, all on security products, and part of the run that brought Cisco to 100 catalogue entries on 30 September.
Because Secure Email Gateway sits between the internet and every inbox it protects, a compromise there undermines a security control rather than a single endpoint.
One crafted email grants root access
Cisco's advisory for CVE-2026-76461 says an attacker with no login can send the gateway an email carrying SQL statements and run commands as root, whatever the device configuration. CISA listed it as exploited on 14 September 2026 and gave federal agencies three days.
For a mail filter, root is the worst case: Secure Email Gateway decides what reaches staff, and an intruder inside it can rewrite that decision rather than slip past it. Cisco told customers to search mail logs for suspicious SQL and to compare firewall and network records kept off the appliance, since root lets an attacker erase local evidence. It also said it had contacted Secure Email Cloud customers where it found malicious activity.