Cisco Secure Email Gateway Zero-Day Exploited to Run Commands as Root
Summary
Cisco says attackers are exploiting CVE-2026-76461, an unauthenticated flaw in Secure Email Gateway that can allow root-level command execution. CISA added it to its KEV catalog and set a September 17 remediation deadline for federal agencies.
Key points
- Cisco says it became aware of exploitation in September 2026 but has not shared attack details or identified the attackers.
- The CVSS 9.8 flaw affects physical and virtual Secure Email Gateway appliances in any configuration; Secure Email and Web Manager and Secure Web Appliance are not affected.
- A specially crafted email can trigger malicious SQL statements, allowing remote, unauthenticated execution of arbitrary commands with root privileges.
- Cisco released indicators of compromise but warned attackers with root access can remove or conceal them.
- CISA added CVE-2026-76461 to its KEV catalog and directed federal organizations to address it by September 17.
Article Details
- Vulnerability Types
- Email parsing
- SQL injection
- Severity
- Critical; CVSS 9.8
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
CVE
CVE-2025-20393This is only the second Cisco Secure Email Gateway vulnerability in the KEV list, after CVE-2025-20393, which China-linked threat actors started exploiting in late 2025.CVE-2026-20079exploitation comes just days after Cisco and CISA warned organizations about attacks leveraging CVE-2026-20079, a Secure Firewall Management Center (FMC) vulnerability disclosed earlier this year.CVE-2026-20316Cisco warned that CVE-2026-20079 and another FMC weakness tracked as CVE-2026-20316 have been exploited by both Russian state-sponsored hackers and profit-driven cybercriminals.CVE-2026-76461The vulnerability is identified as CVE-2026-76461 and has a CVSS score of 9.8.
Vendors
Products
AsyncOSCisco describes it as an email parsing issue in AsyncOS software that can be exploited remotely and without authentication to execute arbitrary commands on the underlying operating system with root privileges.Cisco Secure Firewall Management Centerdays after Cisco and CISA warned organizations about attacks leveraging CVE-2026-20079, a Secure Firewall Management Center (FMC) vulnerability disclosed earlier this year.Cisco Secure Web ApplianceThe security hole affects both the physical and virtual versions of Secure Email Gateway in any configuration. Secure Email and Web Manager and Secure Web Appliance are not impacted.Secure Email and Web ManagerThe security hole affects both the physical and virtual versions of Secure Email Gateway in any configuration. Secure Email and Web Manager and Secure Web Appliance are not impacted.Secure Email GatewayCisco warned customers on Monday that a zero-day vulnerability affecting Secure Email Gateway appliances has been exploited in the wild.