Cisco patches two critical email gateway bugs that let a single message take over the box
Attackers can send a booby-trapped email through a Cisco Secure Email Gateway and gain root. No login required, no workaround available.
Key points
- Cisco disclosed two critical, unauthenticated flaws in Secure Email Gateway on Wednesday, both triggered by a single crafted email passing through the appliance.
- CVE-2026-76519 lets an attacker write files anywhere on the device and run commands as root via a malicious attachment when the file reputation service is on.
- CVE-2026-76461 is a SQL injection in email parsing that also ends in root-level command execution, and it affects every Secure Email Gateway regardless of configuration.
- Cisco says there are no workarounds for either bug; patching is the only fix.
- Secure Email Gateway sits in front of corporate mailboxes to filter spam and malware, so a compromised appliance sees every inbound message.
Cisco has issued software updates for two critical vulnerabilities in its Secure Email Gateway appliance that each let an unauthenticated attacker take full control of the device by sending it an email.
The gateway is the box that filters a company's inbound mail for spam and malicious attachments before it reaches staff inboxes. Which is exactly why a root-level flaw in it is a serious problem: whoever owns the filter can read, alter or drop every message passing through.
What are the two flaws?
Both are critical, both are triggered by a single email, and neither requires the attacker to log in.
The first, CVE-2026-76519, sits in the Advanced Malware Protection feature. When the file reputation service is enabled, meaning the gateway is checking attachments against Cisco's threat database, a crafted attachment can slip past the attachment-handling logic and write arbitrary files to the appliance's operating system. From there the attacker can execute commands as root, the top-level administrator account on Linux systems.
The second, CVE-2026-76461, is a SQL injection flaw, where malicious database commands are smuggled into a field the software expects to contain ordinary data. It lives in the email parsing code of Cisco AsyncOS, the operating system that runs the gateway. A crafted email message containing SQL statements leads, again, to root-level command execution. Cisco's advisory is blunt about scope: the bug affects Secure Email Gateway, physical and virtual, regardless of device configuration.
| Detail | CVE-2026-76519 | CVE-2026-76461 |
|---|---|---|
| Component | Advanced Malware Protection | Email parsing (AsyncOS) |
| Weakness | Arbitrary file write (CWE-23) | SQL injection (CWE-89) |
| Precondition | File reputation service enabled | None (any configuration) |
| Result | Root command execution | Root command execution |
| Workaround | None | None |
Is anyone actually using these bugs?
According to reporting from The Hacker News, attackers are already exploiting the file-write flaw in the wild. Cisco's own advisory confirms the issue and ships fixes, and makes clear there is no configuration tweak that mitigates either vulnerability. The only remedy is the update.
That matters because email gateways are rarely rebooted or touched. A lot of them sit in a rack for years, quietly scanning mail. Administrators who have not looked at theirs recently should assume it is behind.
What should administrators do?
Install the fixed releases listed in Cisco's two advisories, published 10 September 2026 for the arbitrary file write bug and the SQL injection bug. Because exploitation needs only an inbound email, the exposure window is however long the appliance has been reachable from the internet since the flaws became known.
A few practical steps while patching:
- Review mail logs for unusual attachment-processing errors or AMP scan failures in the days before updating.
- Check the appliance for new or modified files outside the normal update paths, and for shell or cron entries that were not placed there by an administrator.
- Rotate any credentials, API tokens or certificates stored on the gateway; a root-level attacker could have read them.
- Treat the device as potentially tampered with until a clean reinstall or vendor-guided integrity check says otherwise.
For ordinary email users there is nothing to click or install. The fix is on the company side. The reasonable thing to watch for is the usual follow-on: unexpected password reset emails, invoice redirects, or messages that look like they came from a colleague but ask for something odd. A broken mail filter is the kind of foothold that gets quiet for weeks before it gets loud.
