Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Active Exploitation of Critical Vulnerability in Cisco AsyncOS

18 September 2026

Attackers are exploiting a critical vulnerability in Cisco AsyncOS to execute arbitrary commands with root privileges. Patch immediately.

Background

Cisco has released security updates to address a critical vulnerability (CVE-2026-76461) affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. This vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 9.8 out of 10.

Impact

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated, remote attacker to send a crafted email message containing malicious SQL statements through an affected device to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Known Exploitation

This vulnerability is reportedly being actively exploited.

Affected Products

The vulnerability affects the following products:

  • Cisco AsyncOS 15.5 and earlier

  • Cisco AsyncOS 16.0

  • Cisco AsyncOS 16.5

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

To confirm any attempted exploitation of this vulnerability, users and administrators are advised to review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, the logs of each cluster device should be reviewed. The presence of any entry in the output may indicate malicious activity.

The following is a non-exhaustive example of how to detect the presence of malicious SQL statements in the logs:

  • cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX (opens in new tab)

https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild/ (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-76461 (opens in new tab)