Critical Cisco Secure Email Gateway Zero-Day Gives Attackers Root Access
Cisco said the flaw let unauthenticated attackers gain root access and monitor email traffic, and it has not said how many customers were affected.
- On Monday, Cisco disclosed critical zero-day CVE-2026-76461 in Cisco Secure Email Gateway, allowing unauthenticated remote attackers to execute commands with root privileges on vulnerable systems.
- Carrying a 9.8 CVSS score, the vulnerability resides in how Cisco AsyncOS handles incoming email, enabling attackers to bypass authentication by sending malicious messages through the gateway.
- More than 400 appliances were exposed as of Monday, per The Shadowserver Foundation, and Cisco released patches in AsyncOS releases 15.5.5-014, 16.0.4-302, and 16.5.0-780.
- Shortly after Cisco's disclosure, The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, mandating remediation by September 17 for federal agencies.
- Researchers at Rapid7 and VulnCheck urge customers to hunt for compromise signs, though Cisco warns that attackers with root access might tamper with logs, complicating detection efforts.
22 Articles
22 Articles
Cisco Email Gateways Fall to One Malicious Message: Root Access via SQL Injection Now in the Wild
Cisco disclosed CVE-2026-76461, a critical SQL injection in AsyncOS email parsing that lets attackers gain unauthenticated root access by sending one crafted message. The zero-day is under active exploitation, with no workarounds available. Organizations must patch immediately and hunt for compromise using external logs.
CSO Online
Network WorldCritical Cisco Secure Email Gateway zero-day gives attackers root access
Cisco released emergency patches for a critical vulnerability in its Secure Email Gateway appliance that could allow attackers to take over the device by simply sending malicious crafted emails to users. The flaw was already being exploited in the wild when the fixes were released. Tracked as CVE-2026-76461, the vulnerability is described by Cisco as an SQL injection caused by insufficient validation in the product’s email parsing code. Parsing …
Cisco warns customers of actively exploited zero-day in email gateways
Attackers of unknown origins and motivations are exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway, authorities and researchers said Monday. The vulnerability — CVE-2026-76461 — was exploited before Cisco disclosed and patched the defect Monday and allows unauthenticated, remote attackers to execute commands with root privileges on vulnerable systems. “In practical terms, that gives the attacker control of the gateway i…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
