Patch Cisco Secure Email Gateway: an exploited flaw gives attackers root, and there is no workaround

If your organization filters email through a Cisco Secure Email Gateway (the physical or virtual appliance that filters your incoming mail), upgrade it. A flaw in how the software processes incoming email lets a remote attacker with no login run commands as root on the device. Cisco says it became aware of active exploitation in September 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 14, 2026.

This one is easy to miss because the advisory is a few weeks old and the appliance sits quietly in the mail path. If yours was never upgraded, treat it as urgent now.

The details

• CVE: CVE-2026-76461
• Severity: CVSS 9.8, critical. No credentials or user action are needed; the attacker only has to get a crafted email to the appliance.
• Affected: Cisco Secure Email Gateway, physical and virtual, regardless of configuration. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected.
• Exploitation: confirmed by Cisco and by CISA’s KEV listing.
• CISA due date: September 17, 2026 for federal agencies. If you serve government or a bank, that date has already passed, so use it as a measure of how overdue you are.
• Workaround: none. Cisco’s advisory states that no workarounds address the flaw.

Fixed releases

Your release train	Upgrade to
15.5 and earlier	15.5.5-014
16.0	16.0.4-302
16.5	16.5.0-780

Cisco strongly recommends that anyone on a release earlier than 16.5 move to 16.5.0-780. Cisco’s advisory describes upgrading either from the web interface (System Administration, then System Upgrade) or with the upgrade command at the CLI. Take a configuration backup first, as you would before any appliance upgrade.

Customers of the hosted Cisco Secure Email Cloud service should ask Cisco Secure Email Cloud support about upgrades. If you bought the appliance without a service contract, or through a reseller who can’t supply the update, the advisory says to contact Cisco’s Technical Assistance Center (TAC) with the serial number and the advisory ID, cisco-sa-esa-inj-2bLVGmhX.

Downloading fixed software requires a valid license from Cisco or an authorized partner. Don’t take firmware from anywhere else.

Check whether you were already hit

Because exploitation started before the fix, upgrading doesn’t tell you the device was clean. Cisco’s advisory suggests:

1. Search the mail logs (mail_logs) for suspicious SQL statements. The advisory gives a non-exhaustive example search for the text COPY.*TO PROGRAM; any match may indicate malicious activity. In a cluster, check every device.
2. Look at your firewall and network logs for the appliance. Root access can hide evidence on the device itself, so look for unexpected uploads from it to outside addresses, or downloads from addresses you don’t recognize.
3. If you suspect compromise of a physical appliance, contact TAC and leave remote access enabled, as the advisory instructs.

If anything turns up, follow your incident response plan and notify whoever your agency or bank policy requires. The free incident response plan template is a starting point. Confirm reporting obligations with your CJIS Systems Agency, examiner, or counsel rather than relying on this article.

Reduce the blast radius going forward

• Keep a list of every internet-facing appliance you run, with its software version and who patches it. Mail gateways are often forgotten.
• Put the appliance’s management interface behind your firewall so only admin workstations can reach it. That doesn’t fix this flaw, since the attack arrives through mail, but it limits what an intruder can do next.
• Subscribe to the vendor’s security advisories so the next one reaches you before it reaches the KEV catalog. Our exposed phone system guide applies the same thinking to another appliance.

Sources

• Cisco Security Advisory cisco-sa-esa-inj-2bLVGmhX: affected products, fixed releases, no workaround, exploitation, and log-check guidance (last updated September 17, 2026)
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-76461 added September 14, 2026, due September 17, 2026