Cisco Patched Zero-Day Vulnerability in Secure Email Gateway Appliances

Cisco has issued a patch for an actively exploited zero-day vulnerability in its Secure Email Gateway appliances. The flaw, identified as CVE-2026-76461, allows attackers to execute arbitrary SQL statements and obtain root privileges on the underlying operating system.

The vulnerability affects versions 16.5, 16.0, and 15.5 and earlier of Cisco AsyncOS Software, running on physical and virtual Secure Email Gateway appliances. It also impacted the cloud-delivered version of the Secure Email Gateway, Cisco Secure Email Cloud.

Cisco became aware of active exploitation in September 2025 and has shared indicators of compromise that organizations can look for to check whether they've been hit.

‘A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system,' Cisco explained. ‘The presence of any entry in the output may indicate malicious activity.'