Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
Cisco warns CVE-2026-76461 (CVSS 9.8), an unauthenticated root RCE in Secure Email Gateway AsyncOS, is actively exploited in the wild.
Cisco confirmed that CVE-2026-76461, a CVSS 9.8 email-parsing flaw in Secure Email Gateway AsyncOS, is being exploited in the wild since September 2026, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted emails containing malicious SQL statements. All physical and virtual SEG configurations are affected; Secure Email and Web Manager and Secure Web Appliance are not. CISA added the flaw to the KEV catalog with a September 17 federal remediation deadline, and Cisco released IoCs while noting root access lets attackers remove them.
- Flaw affects physical and virtual Secure Email Gateway appliances in all configurations
- Exploitation delivers malicious SQL statements inside specially crafted emails
- Second Cisco SEG vulnerability in KEV after CVE-2025-20393, exploited by China-linked actors
- Follows warnings on FMC flaws CVE-2026-20079 and CVE-2026-20316 exploited by Russian hackers
- Cisco PSIRT learned of exploitation in September 2026; attacker attribution unknown
- Vendors
- Cisco
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20393 | Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands | 10.0 | 32% | KEV | KEV |
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at securityweek.com
An unauthenticated attacker can exploit CVE-2026-76461 to execute arbitrary commands on the underlying OS with root privileges. The post Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.