CISA Warns of Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
CISA added actively exploited Cisco Secure Email Gateway SQL injection flaw CVE-2026-76461 to its KEV catalog, enabling unauthenticated root command execution.
CVE-2026-76461 is an unauthenticated SQL injection (CWE-89) in Cisco AsyncOS for Cisco Secure Email Gateway appliances, allowing remote attackers to execute arbitrary OS commands with root privileges. CISA added the flaw to the KEV catalog on September 14, 2026, requiring federal civilian agencies to apply vendor mitigations by September 17, 2026, and forensic triage under BOD 26-04. A compromised gateway could let attackers alter email security policies, access stored messages, disable logging, and pivot into enterprise networks.
- CVE-2026-76461: unauthenticated SQL injection in Cisco AsyncOS enables root command execution
- CISA added flaw to KEV September 14, 2026; mitigation deadline September 17
- Forensic triage required under Binding Operational Directive 26-04
- Unpatched internet-facing appliances should be treated as potentially compromised
- CVEs
- CVE-2026-76461
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA has added a critical Cisco Secure Email Gateway vulnerability to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw in real-world attacks. The issue, tracked as CVE-2026-76461, affects Cisco AsyncOS software used by Cisco Secure Email Gateway appliances. CVE-2026-76461 is an SQL injection vulnerability, categorized under CWE-89.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.