Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

Summary: Cisco warned that CVE-2026-76461, a CVSS 9.8 flaw in AsyncOS for Cisco Secure Email Gateway, is under active exploitation, allowing an unauthenticated remote attacker to send a crafted email with malicious SQL statements and gain root command execution on the underlying operating system. The flaw affects physical and virtual gateways regardless of configuration, has no workarounds other than updating, and CISA added it to the KEV catalog with a September 17, 2026 patch deadline for FCEB agencies.
What's compelling: Root access means attackers can delete or hide the evidence of exploitation on the device itself, so Cisco advises checking network and firewall logs off-box for unexpected uploads to external IPs - and it has already contacted customers whose Cloud devices showed malicious activity, without disclosing the scale.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-76461
Related: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability Known Exploited Vulnerabilities · Sep 14, 2026
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026