Your Email Gateway Just Became a KEV: Cisco CVE-2026-76461 and What to Ask Your MSP

Email is still how invoices, password resets, and “urgent wire” scams arrive. For many SMBs, a Cisco Secure Email Gateway (or an MSP-managed equivalent) sits in front of that flow. When that box has a critical hole with known exploitation, it is not a lab curiosity — it is a business continuity and trust problem.

On September 14, 2026, CISA added CVE-2026-76461 — a Cisco Secure Email Gateway SQL injection vulnerability — to the Known Exploited Vulnerabilities (KEV) catalog. Cisco’s advisory describes the issue in AsyncOS email parsing: an unauthenticated remote attacker can send a crafted email that leads to arbitrary SQL statements and command execution with root privileges on the underlying operating system. Cisco rates it Critical (CVSS 9.8) and states there are no workarounds.

Owner translation: Someone can email your gateway a poison message and, if you are unpatched, potentially take over the appliance as root. CISA listed it because it is actively exploited. Patching is the ticket — not a monitoring promise.

What Cisco Confirmed

• Affected: Cisco Secure Email Gateway, physical and virtual, regardless of configuration.
• Not affected (per Cisco): Secure Email and Web Manager; Secure Web Appliance.
• Fixed releases: 15.5.5-014 (for 15.5 and earlier), 16.0.4-302 (for 16.0), 16.5.0-780 (for 16.5). Cisco strongly recommends migrating older trains to 16.5.0-780 when practical.
• Cloud: Cisco states Secure Email Cloud devices were upgraded to 16.5.0-780; Cisco also contacted cloud customers where malicious activity was detected.
• Exploitation: Cisco PSIRT became aware of active exploitation in September 2026. Advisory first published September 14; updated September 17 with cluster guidance.

Why SMBs and MSP Partners Should Move Fast

• Email appliances are high privilege. They see message content and often sit on sensitive network paths.
• Root on the gateway is a pivot point. Cisco warns successful exploitation can erase or hide evidence — check network and firewall logs outside the box, not only mail_logs.
• Clusters share risk. If one member is compromised, Cisco recommends restoring every cluster member to a secure configuration because SSH keys used between members may be exposed.
• Outsourcing does not outsource ownership. You still need written version, patch date, and any compromise review.

The Ticket I Want Owners to Send Today

“Please confirm whether we use Cisco Secure Email Gateway (on-prem, virtual, or Cisco Secure Email Cloud). If yes: current AsyncOS version, date upgraded to a fixed release (15.5.5-014, 16.0.4-302, or 16.5.0-780), whether mail_logs and external firewall/network logs were reviewed for CVE-2026-76461 indicators after CISA’s September 14, 2026 KEV addition, and whether any cluster members need rebuild/credential rotation. If we do not use Cisco ESA, name the email security product we do use and its current version/patch status for actively exploited flaws.”

How This Fits Everyday Risk Triage

CISA’s KEV list is a prioritization signal for everyone, not only federal agencies. Internet-facing or high-privilege email security jumps the line when exploitation is known. Pair the ticket above with your asset inventory so the next KEV does not start from zero.

Need a calm second opinion on email-gateway exposure or vendor evidence for cyber insurance? CyberIntelPro / Security Medic works MSP-safe with Hudson Valley SMBs and their partners.

References

1. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog” (Sep 14, 2026) — CVE-2026-76461: cisa.gov/…/2026/09/14/…
2. Cisco Security Advisory, Cisco Secure Email Gateway SQL Injection Vulnerability: cisco-sa-esa-inj-2bLVGmhX
3. NVD, CVE-2026-76461: nvd.nist.gov/vuln/detail/cve-2026-76461
4. CISA Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog