Cisco Patches Actively Exploited Secure Email Gateway Zero-Day Allowing Root Command Execution
Summary
Cisco confirmed active exploitation of CVE-2026-76461, which can let unauthenticated attackers run commands as root on Secure Email Gateway appliances. CISA added it to KEV and ordered federal agencies to patch within three days.
Key points
- CVE-2026-76461 affects Cisco AsyncOS email parsing on virtual and physical Secure Email Gateway appliances, regardless of configuration.
- A crafted email containing malicious SQL statements can enable remote, unauthenticated command execution with root privileges.
- Cisco confirmed active exploitation and advised checking device mail_logs for suspicious SQL statements and reviewing network and firewall logs for suspicious transfers.
- Cisco warned attackers may remove evidence of exploitation; Shadowserver tracks more than 400 exposed appliances but did not say how many are secured or honeypots.
- CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch by September 17.
- Cisco also fixed four other critical flaws affecting Secure Email Gateway and Secure Email and Web Manager appliances, with no evidence they were exploited in the wild.
Article Details
- Vulnerability Types
- Insufficient validation in Cisco AsyncOS email parsing that permits malicious SQL statements
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Inspect each cluster device's mail_logs for suspicious SQL statements and review network and firewall logs for suspicious activity, including uploads and downloads to or from external or malicious IP addresses.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterSuccessful exploitation can enable attackers to execute arbitrary commands with root privileges on the underlying operating system.T1190 · Exploit Public-Facing ApplicationAttackers exploited the vulnerable email parsing functionality on affected Cisco Secure Email Gateway appliances to execute commands remotely.T1203 · Exploitation for Client ExecutionA crafted email message containing malicious SQL statements was sent through an affected appliance to exploit its email parsing logic.
CVE
Vendors
Products
Cisco AsyncOSThe security flaw (tracked as CVE-2026-76461) was found in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway and affects virtual and physical appliances, regardless of the device configuration.Cisco Secure Email GatewayCisco warned customers to urgently patch CVE-2026-76461, a critical zero-day in Cisco Secure Email Gateway that is being actively exploited and can let unauthenticated attackers run commands as root.