Cisco Secure Email Gateway Hit by Critical Zero-Day Exploit

Cisco has disclosed a critical SQL injection flaw in its Secure Email Gateway that attackers are already exploiting. The vulnerability, CVE-2026-76461, carries a CVSS score of 9.8 and can let an unauthenticated remote attacker execute commands with root privileges on an affected appliance.

No login or access to the administrative interface is required, and Cisco says there is no workaround. An attacker can target the gateway through the same email-processing path the appliance normally uses to inspect incoming messages.

Cisco's Product Security Incident Response Team became aware of active exploitation in September, and CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14 with a remediation deadline for affected federal civilian agencies set for September 17.

The vulnerability is in the email-parsing logic of Cisco AsyncOS, which allows crafted emails containing malicious SQL statements to trigger arbitrary SQL execution and ultimately command execution with root privileges on the underlying operating system.