Cisco Secure Email Gateway SQLi exploited in wild
An unauthenticated, actively-exploited SQL injection in Cisco Secure Email Gateway allows root-level command execution via a crafted email message.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-76461 as exploited in the wild.
NCSC-NL published a high-priority advisory for CVE-2026-76461, a SQL injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway. The flaw stems from insufficient validation of incoming email messages, allowing an unauthenticated attacker to send a specially crafted email containing malicious SQL statements to a vulnerable system. Successful exploitation enables execution of arbitrary SQL commands, which can subsequently lead to arbitrary command execution with root privileges on the underlying operating system.
Cisco has confirmed that successful exploitation of this vulnerability has been observed in the wild, though the exact exploitation method has not been disclosed. NCSC-NL urges organizations to apply the security update as soon as possible and to check vulnerable systems for indicators of compromise. Cisco has released updates addressing the flaw; defenders should consult Cisco's advisory for IoCs and further technical details.
Given the unauthenticated, remotely exploitable nature of this vulnerability (CVSS 9.8), its position at the email gateway perimeter, root-level impact, and confirmed in-the-wild exploitation, this represents a serious and urgent risk for organizations running affected Cisco Secure Email Gateway deployments.
Mentioned in this report
Detection guidance
Cisco Secure Email Gateway Unexpected SQL Process Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious process spawning from Cisco AsyncOS mail processing daemon with SQL-related command patterns, indicating post-exploitation command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Secure Email Gateway Unexpected SQL Process Execution
description: Detects process creation from Cisco AsyncOS mail processing daemons (MailScanner,
contentfilter, etc.) executing shells or interpreters with SQL or system command
indicators. Typical post-SQLi exploitation behaviour.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- asyncos
- MailScanner
- contentfilter
selection_child:
Image|endswith:
- /bin/sh
- /bin/bash
- /usr/bin/perl
- /usr/bin/python
selection_cmd:
CommandLine|contains:
- 'mysql '
- 'psql '
- 'sqlplus '
- sql
- 'exec '
- system(
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legitimate Cisco system maintenance scripts executing within AsyncOS context
- Third-party mail filter integrations using shell wrappers for database queries
level: high
id: f184b75c-11ec-52e8-9b2a-2519b0f2ae40
status: experimental
author: Vorant
Cisco Secure Email Gateway Elevated Privilege Process Spawning
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects mail gateway daemon processes attempting to spawn root-level shells or system commands, consistent with post-SQLi privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Secure Email Gateway Elevated Privilege Process Spawning
description: Detects mail processing daemons (running as non-root) spawning elevated
shells or su/sudo attempts, which would indicate successful SQLi leading to privilege
escalation.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- asyncos
- MailScanner
- contentfilter
selection_escalation:
CommandLine|contains:
- 'sudo '
- su -
- /bin/sh -i
- /bin/bash -i
Image|endswith:
- /bin/sh
- /bin/bash
- /usr/bin/sudo
- /bin/su
filter_selection_parent_excluded:
User|contains: root
condition: (selection_parent and not filter_selection_parent_excluded) and selection_escalation
falsepositives:
- Legitimate system maintenance requiring elevations within Cisco mail gateway
- Backup and monitoring daemons with legitimate privilege requirements
level: high
id: b33f4ecc-9550-5c77-b0a3-723220719160
status: experimental
author: Vorant
Cisco Secure Email Gateway Unexpected Network Activity from Mail Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects mail processing daemon initiating outbound network connections to non-mail ports, consistent with post-exploitation command execution or data exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Secure Email Gateway Unexpected Network Activity from Mail Process
description: Detects Cisco AsyncOS mail processing daemons initiating outbound connections
to non-standard mail ports (not 25, 587, 110, 143, 993, 995), which is anomalous
for email gateway behaviour and suggests post-SQLi command execution.
tags:
- attack.t1190
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- asyncos
- MailScanner
- contentfilter
DestinationPort|gte: 1024
filter_mail_ports:
DestinationPort:
- 25
- 110
- 143
- 465
- 587
- 993
- 995
filter_local:
DestinationIp|cidr:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_mail_ports and not filter_local
falsepositives:
- Cisco Secure Email Gateway outbound logging or telemetry to internal SIEM/syslog
servers on high ports
- Integration with external LDAP or database services on non-standard ports
level: medium
id: 8a70273b-ead0-57c1-af23-aaf99a43db5b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0368.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs