← Back to SecLog

Cisco warns actively exploited Secure Email Gateway zero-day CVE-2026-76461 gives attackers root remote code execution

Updated: 2026.09.15 1M ago 6 sources
Urgent Patches Zero-Days & CVEs
Cisco says attackers are actively exploiting a critical flaw in Secure Email Gateway appliances that can let outsiders take full control of the device. The bug, CVE-2026-76461 (CVSS 9.8), is an unauthenticated remote code execution issue in AsyncOS email parsing that can be triggered by a specially crafted email and allows arbitrary commands on the underlying operating system with root privileges. Both physical and virtual Secure Email Gateway deployments are affected; Secure Email and Web Manager and Secure Web Appliance are not.
Why it matters: Organizations using Cisco Secure Email Gateway could have their email security appliance fully taken over just by receiving a crafted email, making this an urgent patch-now issue. Defenders should apply Cisco's fix immediately, hunt using the published indicators of compromise, and assume skilled attackers may have hidden traces after gaining root access.

Sources

CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required
Arctic Wolf Labs 2026.09.15 97% relevant
This source is directly about the same CVE-2026-76461 event and adds concrete operational details: the flaw is a pre-authentication SQL injection in email parsing logic, exploitation can occur through a single malicious email with no user interaction, affected/fixed AsyncOS versions, and recommended mitigation steps alongside the CISA KEV deadline.
CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required
Arctic Wolf Labs 2026.09.15 97% relevant
This source covers the same underlying event and adds concrete technical detail that the flaw is a pre-authentication SQL injection in email parsing logic, that exploitation can occur via a single crafted email with no user interaction, and reiterates fixed AsyncOS versions 15.5.5-0141, 16.0.4-3021, and 16.5.0-780 plus the Sept. 17 federal patch deadline after KEV addition.
Cisco email security boxes can be rooted by... an email
2026.09.15 98% relevant
This article is a direct report on the same event and adds practical details from Cisco's advisory: the flaw is triggered by a crafted email processed by AsyncOS, there are no workarounds, Cisco upgraded its Secure Email Cloud devices to AsyncOS 16.5.0-780, and admins are warned attackers with root access may tamper with logs and should rebuild suspected compromised virtual appliances.
Cisco patches Secure Email Gateway zero-day exploited in attacks
Sergiu Gatlan 2026.09.15 98% relevant
This article is the same underlying event: Cisco's disclosure and patching of CVE-2026-76461 in Secure Email Gateway. It adds patch availability, exploitation details, indicators of compromise, and notes that CISA added the flaw to KEV with a three-day federal patch deadline.
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
info@thehackernews.com (The Hacker News) 2026.09.15 99% relevant
The article appears to cover the same event: active in-the-wild exploitation of CVE-2026-76461 in Cisco Secure Email Gateway, which can allow remote root command execution on affected appliances.
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
Eduard Kovacs 2026.09.15 100% relevant
This article appears to be the first tracked report here of the distinct Cisco Secure Email Gateway zero-day CVE-2026-76461 and its active exploitation, making it a new underlying event rather than an update to the separate Cisco FMC stories.
← Back to all stories