Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Cisco warns CVE-2026-76461 in Secure Email Gateway AsyncOS is actively exploited, letting unauthenticated attackers run root commands via crafted emails.
Cisco disclosed CVE-2026-76461, a CVSS 9.8 flaw in AsyncOS for Cisco Secure Email Gateway caused by insufficient validation in email parsing, allowing unauthenticated remote attackers to execute arbitrary SQL statements leading to root command execution. Active exploitation began in September 2026, and CISA added the flaw to its KEV catalog, requiring FCEB agencies to patch by September 17, 2026. Fixes are available in AsyncOS 15.5.5-0141, 16.0.4-302, and 16.5.0-780, with no workarounds. Cisco also contacted Secure Email Cloud customers where malicious activity was detected, and the article separately notes large-scale credential attacks on Fortinet VPN appliances generating tens of millions of authentication failures.
- CVE-2026-76461 scores CVSS 9.8 and is under active exploitation
- Crafted emails with malicious SQL enable unauthenticated root command execution
- CISA added the flaw to KEV; FCEB patch deadline September 17, 2026
- No workarounds; update to AsyncOS 15.5.5-0141, 16.0.4-302, or 16.5.0-780
- Separate waves of Fortinet VPN credential attacks hit US customers in August 2026
- CVEs
- CVE-2026-76461
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
3 min read at thehackernews.com
Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461, carries a CVSS score of 9. 8 out of a maximum of 10.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.