Hackers Exploit Critical Cisco Secure Email Gateway Vulnerability in the Wild to Run Malicious Code
Cisco warns attackers actively exploit zero-day CVE-2026-76461 in Secure Email Gateway, gaining unauthenticated root command execution via crafted emails.
Cisco PSIRT confirmed active in-the-wild exploitation of CVE-2026-76461 throughout September 2026, a zero-day in Secure Email Gateway AsyncOS that lets remote, unauthenticated attackers execute arbitrary commands with root privileges by sending maliciously crafted emails containing injected SQL statements. Physical appliances, virtual deployments, and Cisco Secure Email Cloud instances were affected; Cisco deployed server-side remediations for cloud tenants but on-premises admins must patch themselves. Fixes ship in AsyncOS 16.5.0-780 plus branches 16.0.4-3021 and 15.5.5-0141, and no workarounds exist.
- Zero-day CVE-2026-76461 enables unauthenticated root command injection via crafted emails
- Actively exploited throughout September 2026 across cloud and on-premises deployments
- Patch targets AsyncOS 16.5.0-780 plus 16.0.4-3021 and 15.5.5-0141 branches
- No workarounds; Cisco advises mail log review, forensic snapshots, rebuilds, and credential rotation
- CVEs
- CVE-2026-76461
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at cybersecuritynews.com
Cisco has issued an urgent warning regarding an actively exploited zero-day vulnerability in its Secure Email Gateway appliances that allows remote, unauthenticated attackers to execute arbitrary commands with highest-level root privileges. Tracked as CVE-2026-76461, the flaw stems from a severe parsing breakdown in Cisco AsyncOS Software, enabling adversaries to compromise both physical and virtual deployments […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.