Cisco Warns Customers of Actively Exploited Zero-Day in Email Gateways

A Root-Level Bug Hidden Inside Ordinary Email

Cisco confirmed on Monday, September 14-15, 2026, that a critical flaw in its Secure Email Gateway appliances was exploited in the wild as a zero-day — before a patch existed. The company did not initially describe the nature of the attacks or the scope of impact across its customer base, but it has since published a formal security advisory identifying the issue as CVE-2026-76461, a SQL injection vulnerability in the email-parsing logic of Cisco AsyncOS Software.

What makes the bug especially dangerous is how it's reached: Cisco Secure Email Gateway appliances process externally delivered email as part of their normal job, so exploitation requires no authentication and no access to an administrative interface — an attacker only needs to get a specially crafted email to a vulnerable device. Cisco says successful exploitation lets an attacker execute arbitrary SQL statements that ultimately lead to command execution with root privileges on the underlying operating system.

Incident Overview

Affected and Fixed AsyncOS Versions

According to vendor guidance circulating alongside the advisory, the flaw affects AsyncOS 15.5 and earlier, 16.0, and 16.5. Reported fixed releases include:

• 15.5.5-014
• 16.0.4-302
• 16.5.0-780 (Cisco's preferred/recommended release)

Administrators should confirm exact fixed-version guidance against Cisco's own advisory for their specific hardware and deployment model, since Cisco's published fixed-release tables are the authoritative source and can be refined after initial publication.

What Cisco Has Said

Cisco's Product Security Incident Response Team (PSIRT) said it became aware of active exploitation of CVE-2026-76461 in September 2026, ahead of the public advisory and patch release. The company has directly notified customers running Cisco Secure Email Cloud instances where it identified indicators of possible compromise, and it says it conducted its own threat-intelligence investigation and deployed mitigations for the cloud-hosted service.

Cisco has not published proof-of-concept exploit code, and at the time of writing there is no public attribution for the threat activity behind the exploitation. The vulnerability was disclosed as part of a broader September 2026 security hardening release for Secure Email Gateway and Secure Email and Web Manager, which Cisco says grew out of an internal security review; several other, non-exploited vulnerabilities (including CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443) were patched in the same release.

Notably, there are no workarounds for CVE-2026-76461 — Cisco's guidance is to apply the fixed software directly.

CISA's Response

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalog the same day Cisco disclosed it, a strong signal that exploitation occurred as a genuine zero-day prior to disclosure. CISA has ordered federal civilian agencies to remediate by September 17, 2026 and to check for evidence of prior compromise, not just apply the patch.

This is only the second Cisco Secure Email Gateway vulnerability to land in the KEV catalog — the first was CVE-2025-20393, which China-linked threat actors began exploiting in late 2025.

Why This Matters

Email gateways sit in an unusually privileged position: they're designed to process untrusted, attacker-supplied content (inbound email) by definition, and a compromise typically hands over visibility into — and often control of — an organization's entire mail flow. Combined with root-level code execution and zero authentication, CVE-2026-76461 is about as favorable an exploitation profile as a vulnerability can have: no credentials needed, no user interaction beyond a message arriving, and full OS compromise on success.

Cisco has also warned that because attackers can obtain root privileges, they may be able to remove or hide indicators of compromise to cover their tracks — meaning organizations that only patch, without also hunting for prior compromise, could leave an existing foothold in place. Cisco's remediation guidance for affected physical appliances goes beyond patching: contact the Cisco Technical Assistance Center (TAC), preserve forensic evidence, consider rebuilding from a clean virtual machine image on a fixed release, and rotate all credentials and cryptographic material stored on the appliance.

For any organization running Secure Email Gateway or Secure Email Cloud, this should be treated as an emergency-patch event, not a routine update cycle — especially given the precedent set by CVE-2025-20393's use in nation-state-linked intrusions against similar appliances.

What To Do Now

1. Patch immediately to a fixed AsyncOS release (15.5.5-014, 16.0.4-302, or 16.5.0-780) — there is no workaround.
2. Search mail_logs for suspicious SQL statements or malformed message content consistent with injection attempts.
3. Review firewall and network logs for unexpected outbound connections initiated from affected appliances.
4. Assume compromise until proven otherwise on any internet-facing gateway that was unpatched during the exploitation window, and rotate credentials/certificates stored on the device.
5. Federal agencies: confirm remediation against the September 17, 2026 CISA KEV deadline.

References

• CyberScoop — Cisco warns customers of actively exploited zero-day in email gateways
• Help Net Security — Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)
• SecurityWeek — Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
• BleepingComputer — Cisco patches Secure Email Gateway zero-day exploited in attacks
• Cisco Security Advisory — Cisco Secure Email Gateway SQL Injection Vulnerability