Cisco Secure Email Zero-Day Exploited for Root Access

Cisco has patched a critical zero-day vulnerability in its Secure Email Gateway after confirming that attackers are actively exploiting the flaw to run commands as root on affected systems.

The vulnerability, tracked as CVE-2026-76461, has a CVSS score of 9.8 and affects Cisco AsyncOS software used by Secure Email Gateway appliances. An attacker does not need to log in before attempting exploitation.

Cisco says the weakness exists in the way the product parses email and validates input. A malicious email can reach the system before anyone opens it, making this a particularly dangerous vulnerability.