16 SEP 2026 — A mail gateway stands in front of a company's email and reads everything that arrives. That is the job. Cisco has now disclosed that its own gateway can be taken over by one of those messages.
The flaw, CVE-2026-76461, was published on 14 September, and CISA added it to the Known Exploited Vulnerabilities catalogue the same day, which means it was already being used before anyone outside the attackers knew it existed. It scores 9.8, and there is no workaround.
What the flaw is
The bug is an SQL injection in the email parsing logic of Cisco AsyncOS, the software that runs Secure Email Gateway, the product many organisations still call by its old name, IronPort. According to CyCognito, the gateway fails to validate message content before passing it to a database query.
An attacker sends a message containing SQL statements. The gateway processes it like any other mail, the statements reach the database, and the attacker can then execute commands as root on the appliance's operating system.
Physical appliances and virtual deployments are both affected, and Rapid7 and CyCognito agree that no particular feature configuration is required. Cisco's Secure Email and Web Manager and Secure Web Appliance are not affected.
Why "unauthenticated" means more here than usual
Most critical appliance flaws require the attacker to reach a management interface. That restriction is a meaningful barrier. Management interfaces are usually confined to an internal network or a small set of addresses, and sensible deployments do not expose them.
This one does not need the management interface. The attacker only has to send mail to an address the appliance handles, and accepting mail from strangers is the entire purpose of a mail gateway. No credentials. No click. No user interaction.
That is why the usual interim controls do not help. CyCognito is explicit: restricting management access and segmenting interfaces do not block initial exploitation, and no configuration change fixes the vulnerability.
The versions that matter
The flaw affects AsyncOS releases 15.5 and earlier, 16.0 and 16.5. The fixed builds are 15.5.5-014 for the 15.5 line and earlier, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5.
US federal civilian agencies were given until 17 September to remediate, a three-day window that reflects how CISA reads the risk rather than how long a change-management process usually takes. Everyone else sets their own deadline, and the only useful question is whether the appliance accepted mail from the internet before the patch went on.
What to assume if you were exposed
After a pre-authentication flaw exploited before disclosure, patching stops the next attacker, not the last one. CyCognito says to treat potentially exposed appliances as compromised until proven otherwise. For a mail gateway, that means assuming the device's credentials, and any mail that passed through it during the window, should be considered read.
Both Rapid7 and CyCognito point to the same hunting signature: grep the IronPort text mail logs for SQL "COPY" statements paired with "TO PROGRAM", the construction that turns a database query into command execution. It is narrow and checkable, and a clean result over the relevant period is worth more than a patch date.
Rapid7 said a vulnerability check was expected in its 16 September content release for Exposure Command, InsightVM and Nexpose, which is the practical answer to "how do I find every one of these on my estate".
The other reason to treat the appliance as suspect, not merely unpatched, is what it holds. A mail gateway keeps the credentials it uses to authenticate to directory services and relay mail, often holds quarantined messages, and in many organisations sits inside the network rather than in a DMZ. Root on that device is a position to read from, not just a foothold.
A year of appliances, one shape
CyCognito's exposure data, drawn from service fingerprinting rather than confirmed version detection, puts information technology at 28.7 per cent of observed assets, financials at 23.2 per cent and industrials at 17.1 per cent. Fingerprinting overcounts, because it cannot tell a patched appliance from an unpatched one, but the sector mix is informative: this is a product bought by organisations with compliance obligations about email.
We have written the same paragraph about a Palo Alto firewall, a Check Point VPN and a hosting control panel inside the past week. The common thread is not a single vendor's code quality but the nature of the appliance. These edge devices run with the highest privileges on the network, accept input from anyone, and are the least likely to be rebuilt after a compromise, because rebuilding interrupts everyone's mail.
What to watch
Start with attribution. Neither Cisco nor the vendors analysing this have named who was exploiting it or what they did after getting root. That gap is where the actual cost of the incident will be decided, because a mail gateway is a credential store and an archive as well as a filter.
Then the exploitation curve. Flaws that require only a crafted message are cheap to weaponise once details circulate, and the gap between a KEV listing and broad opportunistic scanning has been days rather than weeks this year.
Watch the disclosure timeline too. Cisco has said its product security team became aware of active exploitation in September, without saying when the first known intrusion occurred, and the distance between those two dates is the part customers cannot yet calculate.
View author profile → · Editorial policy
