A zero-day vulnerability affecting Cisco’s Secure Email Gateway has been exploited in the wild, with the company warning customers that attackers can execute arbitrary commands on the underlying operating system with root privileges. The critical flaw, identified as CVE-2026-76461, affects both physical and virtual versions of the appliance in any configuration.
Cisco described the issue as an email parsing problem in its AsyncOS software, which allows attackers to send malicious SQL statements via specially crafted emails. This enables them to execute arbitrary commands on the device without authentication or authorization, making it a highly severe vulnerability with a CVSS score of 9.8. The company has released indicators of compromise (IoCs) to help identify affected systems, but notes that threat actors can remove or hide IoCs due to their root privileges.
The exploitation of CVE-2026-76461 comes just days after Cisco and the US Cybersecurity and Infrastructure Security Agency (CISA) warned organizations about attacks leveraging a vulnerability in Secure Firewall Management Center (FMC). The two agencies have urged federal organizations to address the issue by September 17, highlighting its importance. Notably, this is only the second Cisco Secure Email Gateway vulnerability listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Cisco has discovered several vulnerabilities in its Secure Email Gateway and Secure Email and Web Manager products internally. The company is urging customers to update their systems as soon as possible to prevent exploitation of CVE-2026-76461. This incident serves as a reminder that even the most secure systems can have vulnerabilities, emphasizing the importance of regular updates and monitoring.
The exploitation of this zero-day vulnerability raises concerns about the potential for targeted attacks on organizations using Cisco’s Secure Email Gateway. With attackers able to execute arbitrary commands with root privileges, they can potentially carry out malicious activities undetected. It is essential for organizations to stay vigilant and take immediate action to protect their systems from this critical flaw.
In light of this incident, it’s crucial for security teams to review their email gateway configurations and ensure that all systems are up-to-date with the latest patches. Regular monitoring of system logs and network traffic can also help detect potential exploitation attempts. By staying proactive in addressing vulnerabilities like CVE-2026-76461, organizations can significantly reduce the risk of successful attacks and maintain a secure environment for their operations.
Source: SecurityWeek — 2026-09-15