CISA Adds Actively Exploited Cisco Secure Email Gateway SQL Injection (CVE-2026-76461) to KEV Catalog

Key facts for Cisco Email SQL injection KEV

Detection coverage for Cisco Email SQL injection KEV

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2508 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AquaTunnel Reverse SSH and Chisel Tunneling to UAT-9686 C2 Infrastructure

Detects command-and-control and lateral-movement activity following Cisco Secure Email Gateway compromise: outbound connections from the appliance to known UAT-9686 C2 IPs (172.233.67.176, 172.237.29.147, 38.54.56.95), reverse SSH tunnel establishment consistent with the AquaTunnel/ReverseSSH implant, and Chisel HTTP-based TCP/UDP tunneling used to pivot into internal network segments.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1572, T1090, T1021.004
• Data sources: firewall_logs, cisco_asa, palo_alto_traffic_logs, cisco_esa_system_logs
• Severity: critical
• Confidence: high

Splunk SPL

(index=network (sourcetype="cisco:asa" OR sourcetype="pan:traffic" OR sourcetype="cisco:esa:system"))
| eval c2_ip=if(match(dest_ip,"^172\.233\.67\.176$|^172\.237\.29\.147$|^38\.54\.56\.95$"),1,0)
| where c2_ip=1 OR (dest_port=22 AND direction="outbound" AND [| inputlookup esa_appliance_ips.csv | fields src_ip]) OR match(app,"(?i)chisel")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip, dest_ip, host
| sort -last_seen

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in ("172.233.67.176", "172.237.29.147", "38.54.56.95")
   or (DestinationPort == 22 and DeviceAction == "allowed" and SourceIP in (esa_appliance_ips))
   or ApplicationProtocol has "chisel"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, ApplicationProtocol
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort

Sigma

title: AquaTunnel Reverse SSH and Chisel Tunneling to UAT-9686 C2 Infrastructure
id: 9a1b2c3d-4e5f-4671-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects outbound network connections from a Cisco Secure Email Gateway to known UAT-9686 C2 IP addresses, and reverse SSH/Chisel tunneling behavior consistent with AquaTunnel used for remote access and internal pivoting after appliance compromise.
references:
    - https://blog.talosintelligence.com/uat-9686/
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1572
    - attack.t1090
    - attack.lateral-movement
    - attack.t1021.004
    - attack.tool.aquatunnel
    - attack.tool.chisel
    - attack.tool.reversessh
logsource:
    category: network_connection
    product: network
detection:
    selection_c2ip:
        DestinationIp:
            - '172.233.67.176'
            - '172.237.29.147'
            - '38.54.56.95'
    selection_tunnel:
        Initiated: 'true'
        DestinationPort: 22
    selection_chisel:
        Image|endswith: 'chisel'
    condition: selection_c2ip or selection_tunnel or selection_chisel
falsepositives:
    - Authorized outbound SSH session from the appliance to an approved Cisco TAC bastion or internal jump host
    - Legitimate internal use of Chisel or comparable tunneling utilities by IT for approved remote-support sessions
level: critical

Known false positives:

• Authorized outbound SSH session from the appliance to an approved Cisco TAC bastion or internal jump host
• Legitimate internal use of Chisel or comparable tunneling utilities by IT for approved remote-support sessions

Tuning notes: Maintain the C2 IP list as a lookup/watchlist (esa_known_c2.csv or a Sentinel watchlist) refreshed from Talos/CISA IOC feeds rather than hardcoding, since UAT-9686 C2 infrastructure rotates; restrict the outbound-SSH-from-appliance leg to appliances with no legitimate reason to originate SSH, and allowlist known TAC support IP ranges to cut false positives.

• 🔒 Cisco Secure Email Gateway SQL Injection to OS Command Execution (CVE-2026-76461) · unlock with TL Creds
• 🔒 AquaShell Webshell Implant and AquaPurge Log Self-Sanitization on Cisco ESA · unlock with TL Creds
• 🔒 AquaTunnel Reverse SSH and Chisel Tunneling to UAT-9686 C2 Infrastructure · unlock with TL Creds
• 🔒 Cisco Secure Email Gateway SQL Injection to OS Command Execution (CVE-2026-76461) · unlock with TL Creds
• 🔒 AquaShell Webshell Implant and AquaPurge Log Self-Sanitization on Cisco ESA · unlock with TL Creds
• 🔒 AquaTunnel Reverse SSH and Chisel Tunneling to UAT-9686 C2 Infrastructure · unlock with TL Creds
• 🔒 Cisco Secure Email Gateway SQL Injection to OS Command Execution (CVE-2026-76461) · unlock with TL Creds
• 🔒 AquaShell Webshell Implant and AquaPurge Log Self-Sanitization on Cisco ESA · unlock with TL Creds

Indicators of compromise for Cisco Email SQL injection KEV

As of 2026-09-15, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2508.

Sample indicators (3 of 17)

• IP address: 172.233.67[.]176
• File hash: 2db8ad6e0f43e93cc557fbda0271a436f9f2a478b1607073d4ee3d20a87ae7ef
• IP address: 172.237.29[.]147

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How Cisco Email SQL injection KEV works

FCEB remediation is due September 17, 2026 under BOD 26-04.

CVE-2026-76461 is a SQL injection vulnerability (CWE-89) in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway (formerly the Cisco Email Security Appliance). Insufficient validation of email content allows an unauthenticated, remote attacker to send a specially crafted email containing malicious SQL statements to an affected device; the injected SQL is used to execute arbitrary operating-system commands with root privileges on the underlying appliance, giving the attacker full control with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8/CRITICAL). Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected by this specific CVE. Cisco published advisory cisco-sa-esa-inj-2bLVGmhX and confirmed evidence of active, in-the-wild exploitation; CISA added the CVE to its Known Exploited Vulnerabilities Catalog the same day (September 14, 2026), triggering a Binding Operational Directive 26-04 remediation deadline of September 17, 2026 for U.S. Federal Civilian Executive Branch agencies, including a requirement to verify whether internet-exposed systems were compromised prior to patching. No workaround exists; Cisco's fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780 (Cisco recommends migrating to 16.5.0-780). Cisco Cloud-hosted Secure Email instances were already patched by the vendor.

This disclosure follows a documented pattern of exploitation against the same appliance family. Cisco Talos assesses with MODERATE confidence that a China-nexus threat actor it tracks as UAT-9686 has been exploiting Cisco Secure Email Gateway and Secure Email and Web Manager appliances since at least late November 2025, publicly disclosed December 10, 2025 alongside Cisco advisory cisco-sa-esa-inj-2bLVGmhX's sibling advisory cisco-sa-sma-attack-N9bf4 (covering the related CVE-2025-20393 Spam Quarantine unauthenticated remote command execution flaw, CVSS 10.0). Talos found overlaps in TTPs, infrastructure, and victimology between UAT-9686 and other China-nexus groups including APT41 and UNC5174. In that campaign, once initial root command execution was obtained on an internet-exposed appliance (Spam Quarantine feature enabled and internet-accessible), the actor deployed a custom lightweight Python backdoor dubbed AquaShell, embedded directly into an existing Python-based web-server file (observed at /data/web/euq_webui/htdocs/index.py), which passively listens for unauthenticated HTTP POST requests carrying encoded commands for shell execution. For remote access and internal pivoting the actor used AquaTunnel, a Golang ELF binary derived from the open-source ReverseSSH project, to establish reverse SSH tunnels, and the open-source tool Chisel for HTTP-based TCP/UDP tunneling to reach internal network segments. To cover its tracks, the actor used AquaPurge, a log-sanitization utility built around egrep-based keyword filtering to strip incriminating entries from appliance logs. Talos and Cisco published IOCs (file hashes and C2 IPs) and Snort rule coverage (SIDs 65617, 65643, 65644, 65645) tied to this campaign. Given the shared vendor, product line, unauthenticated-remote-to-root exploitation pattern, and immediate KEV addition, defenders should treat CVE-2026-76461 exploitation as plausibly connected to the same UAT-9686 campaign infrastructure and tooling, while noting that Cisco's September 14, 2026 advisory and the CISA KEV entry for CVE-2026-76461 do not themselves name an actor. Publicly reported victimology for the UAT-9686 campaign includes government, critical-infrastructure, and telecommunications-sector organizations, with targeting reported in Southeast Asia and Taiwan.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1114 Email Collection

Lateral Movement

T1021.004 SSH; T1210 Exploitation of Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1070.002 Indicator Removal; T1562.001 Impair Defenses

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter; T1059.006 Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Credential Access

T1552 Unsecured Credentials

Resource Development

T1587.004 Develop Capabilities; T1588.006 Obtain Capabilities

defense-impairment

T1685.006 Clear Linux or Mac System Logs

Remediation for Cisco Email SQL injection KEV

Patches

• AsyncOS 15.5.5-0141 (for 15.5 and earlier)
• AsyncOS 16.0.4-3021 (for 16.0)
• AsyncOS 16.5.0-780 (for 16.5; Cisco-recommended migration target)

Immediate actions

• Upgrade Cisco Secure Email Gateway (AsyncOS) to a fixed release immediately: 15.5.5-0141 (for 15.5 and earlier), 16.0.4-3021 (for 16.0), or 16.5.0-780 (for 16.5, Cisco's recommended target) — no workaround exists
• Per BOD 26-04, before patching verify whether internet-exposed appliances were already compromised (forensic triage requirement)
• Restrict or remove internet exposure of the appliance's Spam Quarantine feature and management interfaces
• Search mail/system logs for the SQL injection artifact pattern (e.g. `COPY ... TO PROGRAM`) and for unexpected modifications to /data/web/euq_webui/htdocs/index.py
• Hunt for outbound connections to the known UAT-9686 C2 IPs: 172.233.67.176, 172.237.29.147, 38.54.56.95

Workarounds

• None — Cisco states no workaround exists; upgrading to a fixed release is required

Longer-term hardening

• Deploy file-integrity monitoring on appliance web-server directories to catch webshell implantation such as AquaShell
• Segment internet-facing email security appliances from internal networks to limit reverse-tunnel pivoting (AquaTunnel/Chisel)
• Enable and centrally ship appliance logs off-box so on-device log tampering (AquaPurge) cannot erase evidence
• Apply Cisco Snort rule coverage (SIDs 65617, 65643, 65644, 65645) associated with the related UAT-9686 campaign

Affected and fixed versions

• Cisco — Secure Email Gateway (AsyncOS Software)
  Vulnerable versions: 15.5 and earlier; 16.0 (prior to 16.0.4-3021); 16.5 (prior to 16.5.0-780)
  Fixed in: 15.5.5-0141; 16.0.4-3021; 16.5.0-780

Timeline of Cisco Email SQL injection KEV

Last updated 2026-09-15 · 2 updates · revalidated 2× · latest source

• 2025-11-24 UAT-9686 intrusion activity against internet-exposed Cisco Secure Email Gateway / Secure Email and Web Manager appliances is underway (Cisco Talos reports exploitation since at least late November 2025; exact start date approximate).
• 2025-12-10 Cisco Talos publicly discloses the UAT-9686 campaign (blog.talosintelligence.com/uat-9686), and Cisco publishes advisory cisco-sa-sma-attack-N9bf4 covering the related CVE-2025-20393 Spam Quarantine unauthenticated RCE (CVSS 10.0), detailing the locked-ioc-15, locked-ioc-13, locked-ioc-16, and locked-ioc-17 tooling used against the same appliance family.
• 2026-08-01 Public timeline reconstructions (The Hacker News) place the earliest detected in-the-wild exploitation of CVE-2026-76461 around August 2026, well ahead of Cisco's 2026-09-14 public disclosure (exact date not published).
• 2026-09-01 Cisco TAC identified the SQL injection vulnerability (Cisco Bug ID CSCwu56234) while resolving a customer support case; locked-ioc-12 subsequently confirmed active in-the-wild exploitation in September 2026.
• 2026-09-01 Cisco releases a September 2026 AsyncOS security-hardening update for Secure Email Gateway.
• 2026-09-14 Cisco simultaneously patched four related AsyncOS vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) in the same release, with no evidence of active exploitation for any of the four.
• 2026-09-14 locked-ioc-12 confirmed active in-the-wild exploitation of CVE-2026-76461 prior to patch availability (true zero-day) and stated multiple customers were identified with indicators of compromise, though exact scope was not disclosed.
• 2026-09-14 TL-Intel Harness ingests the CISA KEV addition for CVE-2026-76461 via the CISA Cybersecurity Advisories RSS feed.
• 2026-09-14 The Canadian Centre for Cyber Security publishes advisory AV26-921 covering CVE-2026-76461.
• 2026-09-14 CISA adds CVE-2026-76461 to the Known Exploited Vulnerabilities Catalog citing confirmed active exploitation, setting a BOD 26-04 remediation due date of September 17, 2026 for FCEB agencies.
• 2026-09-14 Cisco publishes advisory cisco-sa-esa-inj-2bLVGmhX disclosing CVE-2026-76461, an unauthenticated SQL injection in AsyncOS email parsing that leads to root-level command execution, and confirms evidence of active exploitation.
• 2026-09-15 Shadowserver reported tracking more than 400 internet-exposed Cisco Secure Email Gateway appliances at the time of public disclosure.
• 2026-09-15 SOC Prime reported that Cisco directly contacted affected cloud-hosted Secure Email Gateway customers regarding CVE-2026-76461.
• 2026-09-17 BOD 26-04 remediation deadline for U.S. Federal Civilian Executive Branch agencies to patch or mitigate CVE-2026-76461.

Update history

• 2026-09-15 — CVE-2026-76461: Cisco Secure Email Gateway Zero-Day Root RCE Exploited in the Wild: What changed No change to severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), or CVSS (9.8) — the existing record was already at maximum on these fields. The newer report adds depth: true pre-patch zero-day exploitation confirmed
• 2026-09-15 — CVE-2026-76461: Critical Cisco Secure Email Gateway SQL Injection Enables Unauthenticated Root RCE: What changed No field escalation: severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), and CVSS (9.8) already match across both reports. The newer report adds the specific SQL-to-OS-command mechanism (PostgreSQL COPY ... TO PROGRA

Sources cited for Cisco Email SQL injection KEV

• CISA Adds One Known Exploited Vulnerability to Catalog CISA · Government advisory · 2026-09-14
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-09-14
• NVD - CVE-2026-76461 NVD (NIST) · Advisory · 2026-09-14
• BOD 26-04: Prioritizing Security Updates Based on Risk CISA · Government advisory · 2026-09-14
• BOD 26-04 Implementation Guidance: Forensic Triage Requirements CISA · Government advisory · 2026-09-14
• Cisco Security Advisory: Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX) Cisco · Vendor report · 2026-09-14
• Cisco Security Advisory: Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager (cisco-sa-sma-attack-N9bf4) Cisco · Vendor report · 2025-12-10
• CVE-2026-76461: Cisco Secure Email SQL Injection (CVSS 9.8) strix.ai · Research · 2026-09-14
• Actively Exploited SQL Injection in Cisco Secure Email Gateway mallory.ai · Research · 2026-09-14
• UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager Cisco Talos · Blog · 2025-12-10

More in vulnerability

• October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs
• Multiple Vulnerabilities in Cisco Products (ISE, ISE-PIC, UCS Central, Unified CM/SME) - CVE-2026-20241, CVE-2026-76419, CVE-2026-76506
• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)