Cisco email security boxes can be rooted by... an email
Attackers actively exploit critical Cisco Secure Email Gateway flaw CVE-2026-76461, turning a malicious email into unauthenticated root access.
Cisco Secure Email Gateway appliances are being actively exploited via CVE-2026-76461, a CVSS 9.8 AsyncOS flaw requiring no authentication—a crafted email can yield root command execution with no workarounds. Cisco's PSIRT became aware of active exploitation in September; some Secure Email Cloud customers showed indicators of compromise and all cloud devices were upgraded to AsyncOS 16.5.0-780. The bug is in CISA's KEV catalog with federal agencies ordered to remediate by September 17; Shadowserver counted 400+ exposed appliances. Fixes are available in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780, and attackers with root may tamper with logs to hide activity.
- CVE-2026-76461 scores 9.8; unauthenticated root via crafted email, no workarounds
- Active exploitation confirmed in September; added to CISA KEV with Sept 17 deadline
- Fixed in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780
- Over 400 appliances internet-exposed per Shadowserver
- Attackers with root can tamper with gateway logs to cover tracks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20393 | Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands | 10.0 | 32% | KEV | KEV |
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at theregister.comAttackers already exploiting the critical flaw, and Cisco warns they may be able to cover their tracks once they're in
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.