IronPort
Email security company acquired by Cisco; originator of AsyncOS.
Cisco bought IronPort Systems for $830m in cash and stock in 2007, and the AsyncOS software that came with it still runs Cisco Secure Email Gateway, where an exploited SQL injection drew a three-day federal patch order in September 2026.
Last refreshed: 12 October 2026
How does a 2007 acquisition still expose Cisco email gateways?
Timeline for IronPort
Mentioned in: Cisco reaches 100 entries on CISA's list
Cybersecurity: Threats and DefencesBackground
IronPort Systems was a privately held company in San Bruno, California, that built appliances for email security, web security and security management. Cisco announced on 4 January 2007 that it would buy the business for $830m in cash and stock, and closed the deal on 25 June 2007.
Cisco absorbed the IronPort products into its own security portfolio, but the operating system beneath them, AsyncOS, survived the merger. Cisco Secure Email Gateway still runs it.
That inheritance resurfaced on 14 September 2026, when CISA listed CVE-2026-76461, an SQL injection in AsyncOS, as exploited. The entry belonged to a September run of Cisco security-product listings that took the company to 100 entries in the catalogue.