Cisco Secure Email Gateway SQLi exploited in wild
An unauthenticated, actively-exploited SQL injection in Cisco Secure Email Gateway allows root-level command execution via a crafted email message.
NCSC-NL published a high-priority advisory for CVE-2026-76461, a SQL injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway. The flaw stems from insufficient validation of incoming email messages, allowing an unauthenticated attacker to send a specially crafted email containing malicious SQL statements to a vulnerable system. Successful exploitation enables execution of arbitrary SQL commands, which can subsequently lead to arbitrary command execution with root privileges on the underlying operating system.
Cisco has confirmed that successful exploitation of this vulnerability has been observed in the wild, though the exact exploitation method has not been disclosed. NCSC-NL urges organizations to apply the security update as soon as possible and to check vulnerable systems for indicators of compromise. Cisco has released updates addressing the flaw; defenders should consult Cisco's advisory for IoCs and further technical details.
Given the unauthenticated, remotely exploitable nature of this vulnerability (CVSS 9.8), its position at the email gateway perimeter, root-level impact, and confirmed in-the-wild exploitation, this represents a serious and urgent risk for organizations running affected Cisco Secure Email Gateway deployments.
Mentioned in this report
Detection guidance
Cisco Secure Email Gateway Unexpected SQL Process Execution
Detects suspicious process spawning from Cisco AsyncOS mail processing daemon with SQL-related command patterns, indicating post-exploitation command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Secure Email Gateway Unexpected SQL Process Execution
description: Detects process creation from Cisco AsyncOS mail processing daemons (MailScanner,
contentfilter, etc.) executing shells or interpreters with SQL or system command
indicators. Typical post-SQLi exploitation behaviour.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- asyncos
- MailScanner
- contentfilter
selection_child:
Image|endswith:
- /bin/sh
- /bin/bash
- /usr/bin/perl
- /usr/bin/python
selection_cmd:
CommandLine|contains:
- 'mysql '
- 'psql '
- 'sqlplus '
- sql
- 'exec '
- system(
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legitimate Cisco system maintenance scripts executing within AsyncOS context
- Third-party mail filter integrations using shell wrappers for database queries
level: high
id: f184b75c-11ec-52e8-9b2a-2519b0f2ae40
status: experimental
author: Vorant
Cisco Secure Email Gateway Elevated Privilege Process Spawning
Detects mail gateway daemon processes attempting to spawn root-level shells or system commands, consistent with post-SQLi privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Secure Email Gateway Elevated Privilege Process Spawning
description: Detects mail processing daemons (running as non-root) spawning elevated
shells or su/sudo attempts, which would indicate successful SQLi leading to privilege
escalation.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- asyncos
- MailScanner
- contentfilter
selection_escalation:
CommandLine|contains:
- 'sudo '
- su -
- /bin/sh -i
- /bin/bash -i
Image|endswith:
- /bin/sh
- /bin/bash
- /usr/bin/sudo
- /bin/su
filter_selection_parent_excluded:
User|contains: root
condition: (selection_parent and not filter_selection_parent_excluded) and selection_escalation
falsepositives:
- Legitimate system maintenance requiring elevations within Cisco mail gateway
- Backup and monitoring daemons with legitimate privilege requirements
level: high
id: b33f4ecc-9550-5c77-b0a3-723220719160
status: experimental
author: Vorant
Cisco Secure Email Gateway Unexpected Network Activity from Mail Process
Detects mail processing daemon initiating outbound network connections to non-mail ports, consistent with post-exploitation command execution or data exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Secure Email Gateway Unexpected Network Activity from Mail Process
description: Detects Cisco AsyncOS mail processing daemons initiating outbound connections
to non-standard mail ports (not 25, 587, 110, 143, 993, 995), which is anomalous
for email gateway behaviour and suggests post-SQLi command execution.
tags:
- attack.t1190
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- asyncos
- MailScanner
- contentfilter
DestinationPort|gte: 1024
filter_mail_ports:
DestinationPort:
- 25
- 110
- 143
- 465
- 587
- 993
- 995
filter_local:
DestinationIp|cidr:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_mail_ports and not filter_local
falsepositives:
- Cisco Secure Email Gateway outbound logging or telemetry to internal SIEM/syslog
servers on high ports
- Integration with external LDAP or database services on non-standard ports
level: medium
id: 8a70273b-ead0-57c1-af23-aaf99a43db5b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0368.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free