Cisco email gateways face reported root-access flaw triggered by an email

Incoming-email parsing becomes the reported entry point

The report says CVE-2026-76461 affects physical and virtual Cisco Secure Email Gateway appliances regardless of configuration. It describes a flaw in AsyncOS handling of incoming email: an attacker reportedly needs no login and can send a booby-trapped message that, if exploitation succeeds, runs commands as root.

Cisco reportedly became aware of active exploitation in September and said attackers with root access could alter logs to conceal their activity. The report says fixed AsyncOS releases include 15.5.5-014, 16.0.4-302, and 16.5.0-780.

Affected Cisco Secure Email Gateway appliances were intended to inspect incoming email, including potentially hostile messages.

A malicious email is now reported to be able to give an unauthenticated attacker root-level command execution on affected gateways; Cisco says there is no workaround, so patching is the stated remedy.

The focus is the gateway’s own email-processing function becoming a possible route to root privileges. The report also warns that attackers may alter logs, so clean gateway logs alone cannot establish that no compromise occurred.