Cybersecurity giant Cisco has issued a critical patch for its Secure Email Gateway (SEG) product, warning customers that threat actors have been exploiting a previously unknown vulnerability to execute arbitrary commands with root privileges on underlying operating systems. The flaw, tracked as CVE-2026-76461, affects both virtual and physical appliances running Cisco AsyncOS Software, regardless of configuration.
The vulnerability stems from insufficient validation in the email parsing logic, allowing attackers to send malicious SQL statements through affected devices. A successful exploit could grant attackers root access on the underlying operating system, enabling them to execute arbitrary commands with devastating consequences. According to Cisco’s security advisory, indicators of compromise include suspicious SQL statements in each cluster device’s mail logs.
While it is unclear how many devices are vulnerable or have already been compromised, internet security watchdog Shadowserver estimates that over 400 Cisco SEG appliances are currently online. To mitigate the risk, network defenders are advised to look for signs of suspicious activity, including uploads and downloads to and from external or malicious IP addresses. However, as attackers may attempt to erase evidence of exploitation, admins should also cross-check network and firewall logs.
The Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2026-76461 flaw to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal agencies to patch their systems within three days. This is not the first critical vulnerability affecting Cisco’s SEG product; in January, the company patched a maximum-severity flaw exploited in zero-day attacks against SEG and SEWM devices.
Cisco has also recently revealed that multiple ransomware and state-sponsored threat groups have targeted its Secure Firewall Management Center (FMC) appliances. Since November 2021, CISA has flagged 98 Cisco vulnerabilities as actively exploited in attacks, including seven abused by ransomware gangs. With the continued emergence of high-severity vulnerabilities, it is essential for organizations to prioritize patch management and maintain up-to-date software.
For those relying on Cisco’s SEG product, a critical takeaway from this incident is the importance of regular security updates and monitoring. While the exact number of affected devices remains unknown, the risk of exploitation is real. To minimize exposure, network administrators should promptly apply the latest patches, scrutinize logs for signs of suspicious activity, and maintain robust backup procedures to ensure business continuity in the event of a breach.
Source: Bleeping Computer — 2026-09-15