Cisco has warned customers that a critical zero-day vulnerability in its Secure Email Gateway has been exploited in the wild, potentially allowing unauthenticated attackers to execute commands with root privileges on affected devices.

 

What happened

According to Cybersecurity News, Cisco disclosed the vulnerability, tracked as CVE-2026-76461, on September 14 and warned that attackers were already exploiting it. The vulnerability has a CVSS base score of 9.8 out of 10 and is rated Critical by Cisco.

Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation in September 2026. The company said the vulnerability was discovered while investigating a Cisco Technical Assistance Center support case. The flaw affects the email-parsing functionality of Cisco AsyncOS. An unauthenticated, remote attacker can exploit the vulnerability by sending a specially crafted email containing malicious SQL statements through an affected Secure Email Gateway. Successful exploitation can allow an attacker to execute arbitrary SQL statements and, ultimately, commands on the underlying operating system with root privileges.

Cisco has released security updates for affected versions of AsyncOS, including version 15.5.5-014 for version 15.5 and earlier, 16.0.4-302 for version 16.0, and 16.5.0-780 for version 16.5. The company recommends that customers migrate to AsyncOS 16.5.0-780 where possible.

 

Going deeper

CVE-2026-76461 is classified as an SQL injection vulnerability caused by insufficient validation in Cisco AsyncOS's email-parsing logic. Rather than requiring an attacker to authenticate to the device, the vulnerability can be triggered remotely through a crafted email message.

The attack chain is significant because exploitation can move beyond manipulating application data. According to Cisco, successful exploitation can result in arbitrary command execution with root privileges on the underlying operating system. This level of access could give an attacker substantial control over an affected email-security appliance. Cisco has warned that attackers with root-level command execution may also be able to remove or hide evidence of their activity. As a result, checking only the affected appliance's logs may not be sufficient when investigating a potential compromise. Cisco recommends administrators also review network and firewall logs outside the device for suspicious activity, including unexpected connections, uploads, or downloads involving external or malicious IP addresses.

Cisco has also provided indicators of compromise that organizations can use when investigating affected systems. Security teams should review the mail_logs on affected devices for suspicious SQL statements and, where appliances are clustered, examine the logs of each device.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) Catalog, reflecting the confirmed exploitation of the vulnerability. U.S. federal civilian agencies have been directed to remediate the flaw by September 17, 2026.

 

What was said

In its September 14 security advisory, Cisco described CVE-2026-76461 as a critical vulnerability in the email-parsing functionality of Cisco AsyncOS for Secure Email Gateway. The company said the flaw could allow an unauthenticated remote attacker to “execute arbitrary commands with root privileges on the underlying operating system.” Cisco explained that the vulnerability results from “insufficient validation in the email parsing logic.”

According to the company, an attacker can exploit the flaw by sending a specially crafted email containing malicious SQL statements through an affected device. A successful attack can allow the attacker to execute arbitrary SQL statements and ultimately gain root-level command execution. Cisco also warned that attackers who successfully exploit the vulnerability may be able to conceal their activity. “Evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors,” the company said, due to the level of access provided by the vulnerability.

The company recommended that administrators review mail_logs for suspicious SQL statements and cross-check network and firewall logs for potentially malicious activity. Cisco also said there are no workarounds for the vulnerability and strongly recommended upgrading affected appliances to a fixed software release.

 

In the know

A Secure Email Gateway (SEG) is a security solution that sits between an organization's email system and the internet to inspect incoming and outgoing messages. SEGs help organizations identify and block threats such as phishing emails, malware, spam, malicious links, and suspicious attachments before they reach users.

SEGs can use multiple security controls to assess email messages, including spam filtering, malware detection, URL scanning, attachment analysis, and email authentication checks. They may also enforce organizational email security policies and monitor messages for potential threats.

Since SEGs process large volumes of email and sit at an important point in an organization's communications infrastructure, they can become an attractive target for cybercriminals. A vulnerability in an SEG could potentially allow attackers to bypass email security controls or gain access to the underlying system, making timely patching and monitoring important security measures.

 

Why it matters

The Cisco Secure Email Gateway vulnerability is significant because it affects a security system that sits directly in the path of an organization's email traffic. Additionally, CVE-2026-76461 has a CVSS score of 9.8 and is being actively exploited, meaning organizations using affected versions of Cisco AsyncOS face a vulnerability that attackers are already targeting.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

What is a CVSS score?

The Common Vulnerability Scoring System (CVSS) is a framework used to communicate the severity of security vulnerabilities. Scores range from 0 to 10, with 9.0–10.0 classified as critical. CVE-2026-76461 has a CVSS score of 9.8.

 

What is an SQL injection?

An SQL injection is a type of cyberattack where an attacker sends malicious commands to a database through an application. If the system does not properly check the input, the attacker may be able to access, change, or delete data or execute other unauthorized commands.

 

Why are email systems targeted by cybercriminals?

Email is widely used for communication and can provide attackers with a way to deliver malicious links, attachments, or other content. Email infrastructure can therefore be an attractive target for attackers seeking access to an organisation's systems or information.