Cisco updates its fix for exploited Secure Email Gateway flaw that gives root
- Affected
- Every Secure Email Gateway release before its branch’s fixed release, on physical and virtual appliances, Cisco says. All versions and fixes
- Vendor
- Cisco
A flaw in Cisco Secure Email Gateway, , lets an unauthenticated attacker run commands as root by sending a crafted email through the appliance. Cisco learned of attacks in September and published its advisory on Sep 14. On Nov 3, it said it had updated the fix in 15.5.5-014 on Oct 31 because of new information about exploit code available online. It now tells customers on releases before 16.5 to move to 16.5.0-780.
The flaw is in how AsyncOS, the gateway’s software, parses email, Cisco says. A crafted message carrying SQL statements lets the attacker run them, which leads to commands as root on the underlying operating system. It affects physical and virtual appliances whatever their configuration, and there’s no workaround. Cisco rates it 9.8 under CVSS 3.1. Secure Email and Web Manager and Secure Web Appliance aren’t affected.
CISA added the flaw to KEV on Sep 14, the day Cisco published its advisory. The Nov 3 revision of the advisory doesn’t describe the exploit code or say where it was posted. To confirm the updated 15.5.5-014 fix is installed, Cisco says to check that Cisco Retro Remediation Engine runs version 4.0.2 or later. Release 16.5.0-780 fixes the flaw whatever the engine’s version.
Cisco upgraded every Secure Email Cloud appliance to 16.5.0-780, and it contacted cloud customers whose appliances showed possible signs of compromise. Because an attacker with root can remove or hide evidence, Cisco says to check network and firewall logs outside the appliance. A compromised appliance’s SSH keys may also let the attacker into the other members of its cluster.
- Vendor
- Cisco
What to do
7 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Cisco Secure Email Gateway 15.5 and earlier | Releases before 15.5.5-014 | 15.5.5-014 with Cisco Retro Remediation Engine 4.0.2 or later |
| Cisco Secure Email Gateway 16.0 | Releases before 16.0.4-302 | 16.0.4-302 or later |
| Cisco Secure Email Gateway 16.5 | Releases before 16.5.0-780 | 16.5.0-780 or later |
- Product
- Cisco Secure Email Gateway 15.5 and earlier
- Affected
- Releases before
15.5.5-014 - Fixed
15.5.5-014with Cisco Retro Remediation Engine4.0.2or later
- Product
- Cisco Secure Email Gateway 16.0
- Affected
- Releases before
16.0.4-302 - Fixed
16.0.4-302or later
- Product
- Cisco Secure Email Gateway 16.5
- Affected
- Releases before
16.5.0-780 - Fixed
16.5.0-780or later
Timeline
- Sep 14Cisco publishes its advisory, and CISA adds the flaw to KEV.
- Sep 17Cisco adds guidance for clustered appliances to the advisory.
- Oct 31Cisco releases an updated fix for
15.5.5-014, citing new information about exploit code available online. - Nov 3Cisco revises its advisory to describe the updated fix.
Sources
- Cisco advisoryPrimary source sec.cloudapps.cisco.com
- CISA KEV catalog CVE-2026-76461Primary source cisa.gov