What is CVE-2026-76461?

CVE-2026-76461 is a critical SQL injection vulnerability (CWE-89) in Cisco AsyncOS for Secure Email Gateway (formerly IronPort ESA / Cisco Email Security Appliance). An unauthenticated remote attacker can send a crafted email containing malicious SQL to an affected device, execute arbitrary SQL, and achieve command execution as root on the underlying operating system. Cisco rates the issue CVSS 3.1 9.8 Critical (Cisco security advisory cisco-sa-esa-inj-2bLVGmhX, September 14, 2026).

When must federal agencies patch CVE-2026-76461?

Under BOD 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies must remediate CVE-2026-76461 by September 17, 2026, the due date CISA assigned when adding the CVE to the Known Exploited Vulnerabilities catalog on September 14, 2026. Forensic triage is required — agencies cannot treat "version bumped" as residual-risk closed without a compromise assessment. CISA's alert is dated September 14, 2026 (CISA KEV alert, September 14, 2026).

What Cisco AsyncOS versions fix CVE-2026-76461?

Cisco's fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Cisco recommends migrating to 16.5.0-780 (the long-term branch). Cisco Cloud-hosted Secure Email instances were already patched by the vendor; the issue affects physical and virtual on-premises appliances regardless of configuration. There are no workarounds (Cisco security advisory cisco-sa-esa-inj-2bLVGmhX, September 14, 2026).

Who is exploiting CVE-2026-76461?

Cisco Talos assesses with moderate confidence that a China-nexus threat actor it tracks as UAT-9686 has been exploiting Cisco Secure Email Gateway and Secure Email and Web Manager appliances since at least late November 2025. Talos found overlaps in TTPs, infrastructure, and victimology between UAT-9686 and other China-nexus groups including APT41 and UNC5174. Publicly reported victimology includes government, critical-infrastructure, and telecommunications-sector organizations in Southeast Asia and Taiwan (Talos threat assessment, September 14, 2026).

What malware does UAT-9686 use after exploitation?

After gaining root command execution on an internet-exposed appliance, UAT-9686 deploys AquaShell, a custom lightweight Python backdoor embedded directly into an existing Python-based web-server file. AquaShell passively listens for unauthenticated HTTP POST requests carrying encoded commands for shell execution. For remote access and internal pivoting, the actor uses AquaTunnel, a Golang ELF binary derived from the open-source ReverseSSH project. To cover tracks, the actor deploys AquaPurge, a log-cleaning tool built around egrep-based keyword filtering (Talos threat assessment, September 14, 2026).

How do I detect CVE-2026-76461 exploitation on my appliances?

Cisco's IoC package recommends reviewing mail_logs for suspicious SQL, with example detection signatures based on `COPY.*TO PROGRAM` patterns in IronPort text mail logs around lines 67109-67110. Cisco also warns that root access can remove or hide on-box evidence, so firewall logs should be reviewed for unexpected uploads from and downloads to known malicious IPs. Talos published file hashes and C2 IPs, plus Snort rule coverage with SIDs 65617, 65643, 65644, 65645 (Cisco security advisory; Talos IoC package, September 14, 2026).

What is the disclosure timeline for CVE-2026-76461?

Cisco TAC identified the SQL injection vulnerability (Bug ID CSCwu56234) on September 1, 2026, while resolving a customer support case. Cisco PSIRT subsequently confirmed active in-the-wild exploitation in September 2026. The security advisory cisco-sa-esa-inj-2bLVGmhX was published September 14, 2026, and CISA added the CVE to KEV the same day. There was no pre-disclosure notification window — this is a true zero-day that was found in the wild before a patch was available (Cisco PSIRT advisory, September 14, 2026).

Cisco Email Gateway CVE-2026-76461: CISA KEV Patch Sep 17

Quick Answer

CVE-2026-76461 is a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway's AsyncOS; added to CISA KEV on September 14, 2026 with a federal due date of September 17, 2026. Active exploitation is attributed with moderate confidence to a China-nexus actor tracked as UAT-9686, the same group behind the December 2025 Cisco appliance campaign. Fixed in AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780.

Last verified: Sep 16, 2026.

At a glance

CVE: CVE-2026-76461
CVSS: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected: Cisco Secure Email Gateway (physical/virtual) running AsyncOS 15.5, 16.0, and earlier
Fixed: AsyncOS 15.5.5-0141, 16.0.4-3021, 16.5.0-780
CISA KEV: Added September 14, 2026; due September 17, 2026; forensic triage Yes
Actor: UAT-9686 (China-nexus, moderate confidence per Talos)
Malware: AquaShell backdoor, AquaTunnel (ReverseSSH), AquaPurge log cleaner

What the vulnerability is

Insufficient validation of email content allows a crafted message with malicious SQL to be processed into SQL execution and then root OS command execution. Authentication is not required, user interaction is not required, and the attacker only needs network reachability to the appliance. Physical and virtual Secure Email Gateway appliances are affected regardless of device configuration. Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected by this specific CVE, though they share the AsyncOS codebase (Cisco security advisory cisco-sa-esa-inj-2bLVGmhX, September 14, 2026).

Rapid7 assesses pre-disclosure (zero-day) exploitation. Rapid7 and Beazley reported no public proof-of-concept at their publication dates, though the IoC package from Cisco is sufficient to build detection. No public threat-actor attribution appears in Cisco, CISA, Rapid7, or Beazley coverage reviewed for this advisory — attribution to UAT-9686 comes from Talos's separate threat assessment (Rapid7, Beazley, Talos, September 14, 2026).

What attackers do after exploiting it

The UAT-9686 playbook chains the SQL injection with three custom tools. AquaShell is a lightweight Python backdoor embedded directly into an existing Python-based web-server file — observed at `/data/web/euq_webui/htdocs/index.py` — that passively listens for unauthenticated HTTP POST requests carrying encoded commands for shell execution. AquaTunnel is a Golang ELF binary derived from the open-source ReverseSSH project, used to establish reverse SSH tunnels for remote access and internal pivoting. AquaPurge is a log-cleaning tool built around egrep-based keyword filtering to scrub appliance logs of attacker activity (Talos threat assessment, September 14, 2026).

Once internal access is established, the actor uses HTTP-based TCP/UDP forwarding to reach internal network segments, then pivots to higher-value targets — historically government, critical infrastructure, and telecom organizations, with reported targeting in Southeast Asia and Taiwan. The pattern matters for defenders: a single appliance compromise can become a multi-tenant breach depending on the appliance's network position.

How to patch — and verify the patch

There are no workarounds; patching is the only remediation. Cisco recommends migrating to AsyncOS 16.5.0-780 on the long-term branch, though 15.5.5-0141 and 16.0.4-3021 are acceptable interim fixes for environments that cannot yet jump branches. Cisco Cloud-hosted Secure Email instances were already patched by the vendor, so the issue is effectively on-premises-only (Cisco security advisory, September 14, 2026).

Under BOD 26-04, federal agencies must complete remediation by September 17, 2026, with forensic triage required. Because the actor can remove on-box evidence, a compromise assessment is mandatory before treating "version bumped" as residual-risk closed. Detection should look for SQL patterns in `mail_logs` (specifically `COPY.*TO PROGRAM` patterns around lines 67109-67110), unexpected uploads/downloads to known malicious IPs in firewall logs, and process execution patterns from the appliance's Python web server that are not part of normal operation.

What enterprise defenders should do now

Three immediate actions for any organization running on-premises Cisco Secure Email Gateway.

Inventory and prioritize: Pull AsyncOS versions from every appliance; anything below 15.5.5-0141 / 16.0.4-3021 / 16.5.0-780 is at risk. Prioritize internet-exposed appliances first.
Schedule the patch window: AsyncOS upgrades require a reboot. Plan for a 30-60 minute outage per appliance, with mail queue draining. Run the upgrade during low-traffic windows.
Run the IoC sweep: Apply the Talos Snort SIDs (65617, 65643, 65644, 65645) to historical PCAP and firewall logs covering at least the past 90 days. Hunt for AquaShell execution on appliance management interfaces and for AquaTunnel outbound SSH tunnels.

What this tells us about the broader email security landscape

The Cisco appliance remains the highest-volume email security gateway on the market, which makes it a permanent target for state-aligned actors. This is the second disclosed Cisco appliance zero-day tied to UAT-9686 in 2026 — the prior campaign exploited CVE-2025-20393 in the Spam Quarantine feature of Secure Email and Web Manager (CVSS 10.0), disclosed December 10, 2025. The recurrence suggests UAT-9686 has dedicated capacity to find and weaponize AsyncOS issues at scale (Talos, December 10, 2025; September 14, 2026).

For organizations evaluating alternatives: Proofpoint, Mimecast, and Microsoft Defender for Office 365 do not share this AsyncOS codebase, though each carries its own distinct attack surface. The lesson is not that Cisco is uniquely vulnerable — every gateway has a codebase that needs to be patched — but that patching cadence matters more than vendor choice when state-aligned actors are actively targeting email infrastructure. Plan for monthly emergency patch windows, not quarterly.