Cisco Zero-Day in Secure Email Gateway Exploited for Root Access
Summary
Cisco says attackers actively exploited CVE-2026-76461, an unauthenticated root-level command-execution flaw in Secure Email Gateway. Cisco contacted cloud customers with possible compromise indicators and released patches and hunting guidance.
Key points
- CVE-2026-76461 affects Cisco Secure Email Gateway running AsyncOS and allows unauthenticated remote command execution with root privileges.
- Cisco says it became aware of active exploitation in September, before publicly disclosing and patching the flaw.
- Cisco said multiple customers were likely compromised before disclosure but did not specify how many organizations were affected.
- The vulnerability affects cloud-based and on-premises deployments; CISA added it to its Known Exploited Vulnerabilities catalog.
- Cisco contacted cloud customers whose devices showed indicators of possible compromise and said it was conducting remediation and recovery.
- Rapid7 and VulnCheck urged customers to patch and hunt for compromise; Cisco released indicators but warned attackers may hide or remove traces.
Article Details
- Vulnerability Types
- Unauthenticated remote command execution
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1040 · Network SniffingA VulnCheck director said exploitation could let an attacker monitor communications on the compromised email gateway.T1059 · Command and Scripting InterpreterSuccessful exploitation allows unauthenticated remote attackers to execute commands with root privileges on the gateway.T1190 · Exploit Public-Facing ApplicationAttackers exploit the vulnerability in Cisco Secure Email Gateway to gain access to vulnerable appliances.T1210 · Exploitation of Remote ServicesA Rapid7 director said attackers could pivot internally from an on-premises compromised gateway.
CVE
People
Vendors
Products
Cisco AsyncOSCisco said its product security incident response team became aware of active exploitation of the defect affecting Cisco AsyncOS Software for Cisco Secure Email Gateway in September.Cisco Secure Email GatewayAttackers are exploiting CVE-2026-76461, a critical zero-day in Cisco Secure Email Gateway that allows unauthenticated remote command execution with root privileges.