Cisco revises fix for exploited Secure Email Gateway flaw CVE-2026-76461
Cisco has revised remediation guidance for CVE-2026-76461, an exploited flaw that gives unauthenticated attackers root access on Secure Email Gateway. On AsyncOS 15.5.5-014, the revised fix also requires Retro Remediation Engine 4.0.2 or later, checkable with the retroscannerstatus command. For older branches, Cisco recommends AsyncOS 16.5.0-780.
What happened
Cisco has revised the fix for CVE-2026-76461, an already exploited email gateway flaw that gives attackers root access without authentication. The change: on AsyncOS 15.5.5-014, the fix also requires Retro Remediation Engine 4.0.2 or later.
Why it matters
Secure Email Gateway handles corporate email and root access gives the attacker full control. The flaw is already exploited, and organizations that applied only the OS update, without the engine update, remain exposed.
What to do
Run retroscannerstatus to check the engine version, update to 4.0.2 or later on AsyncOS 15.5.5-014, and migrate older branches to AsyncOS 16.5.0-780.
For the technical team
- CVE
- CVE-2026-76461
- Affected
- Cisco Secure Email Gateway (AsyncOS) · AsyncOS 15.5.5-014 and older branches.
- Exploitation
- The source (DailyDarkWeb, on Cisco's revised guidance) describes the flaw as already exploited. No mention of public PoC or KEV in the text.
- Fix
- AsyncOS 15.5.5-014 with Retro Remediation Engine 4.0.2 or later; for older branches, Cisco recommends AsyncOS 16.5.0-780. Check the engine with the retroscannerstatus command.
- Vector
- Flaw in Cisco Secure Email Gateway (AsyncOS) that allows an unauthenticated attacker to gain root access on the system.
- More details
- Cisco's revised guidance creates a fix dependency: the 15.5.5-014 patch is only complete with the Retro Remediation Engine updated, verified via retroscannerstatus.
Timeline
Batch adds Cisco's revised guidance: the 15.5.5-014 fix also requires Retro Remediation Engine 4.0.2 or later, with 16.5.0-780 recommended for older branches.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
