Cisco has issued an alert to its customers regarding a zero-day vulnerability in its Secure Email Gateway appliances. This flaw, which is actively being exploited, poses significant security risks.
Details of the Vulnerability
The vulnerability, designated as CVE-2026-76461, has been given a severity score of 9.8 on the CVSS scale. It is described by Cisco as a critical issue in the AsyncOS software that can be remotely exploited without authentication. This allows attackers to execute arbitrary commands on the operating system with root privileges.
The vulnerability permits the execution of malicious SQL commands via specially crafted emails sent to targeted users. This flaw was first identified by Cisco’s Product Security Incident Response Team (PSIRT) in September 2026, although specifics about the attacks remain undisclosed.
Impact and Response
Cisco has provided indicators of compromise (IoCs) to help detect exploits, but notes that attackers with root access can potentially remove these traces. Both physical and virtual configurations of the Secure Email Gateway are affected, but other products like the Secure Email and Web Manager and Secure Web Appliance are not impacted.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal entities to address the issue by September 17. This vulnerability is the second of its kind in Cisco’s email gateway products to appear on the KEV list, following a previous exploit by China-linked groups.
Broader Security Context
The discovery of CVE-2026-76461 occurs in the context of other recent vulnerabilities. Notably, Cisco and CISA have also warned about the exploitation of CVE-2026-20079, a vulnerability in the Secure Firewall Management Center, which has been targeted by both Russian state-sponsored hackers and financially motivated cybercriminals.
These incidents highlight ongoing challenges in cybersecurity, emphasizing the need for organizations to remain vigilant and update their systems promptly. Such vulnerabilities underscore the critical importance of security measures in safeguarding digital infrastructures.
As cyber threats evolve, staying informed and prepared is essential for protecting valuable information and maintaining trust in digital communication systems.
