Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76461 enabling unauthenticated root command execution; CISA adds it to KEV.
Cisco disclosed that a critical zero-day (CVE-2026-76461) in the email parsing logic of AsyncOS for Secure Email Gateway is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL statements that lead to root-level command execution on virtual and physical appliances. CISA added the flaw to its KEV catalog and ordered federal agencies to patch within three days, by September 17. Cisco also patched four other critical SEG/SEWM vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) with no evidence of exploitation, and shared IOCs including suspicious SQL statements in mail_logs.
- CVE-2026-76461 is actively exploited as a zero-day in Cisco Secure Email Gateway.
- Unauthenticated attackers can gain root command execution via crafted email with SQL statements.
- CISA KEV listing requires federal patching by September 17.
- Shadowserver tracks 400+ internet-exposed Secure Email Gateway appliances.
- Four additional critical SEG/SEWM flaws patched with no observed exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20393 | Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands | 10.0 | 32% | KEV | KEV |
CVE-2026-20353+2 related CVEs | Critical Unauthenticated Flaws in Cisco Secure Email Gateway & Email/Web Manager | 9.8 | — | ||
| CVE-2026-76441 | Unauthenticated Improper Access Control in Cisco Secure Email Gateway and Web Manager | 9.8 | — | ||
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at bleepingcomputer.com
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.