GoKawiilCisco patches actively exploited zero-day in Secure Email Gateway software
Cisco released fixes for CVE-2026-76461, a critical flaw in AsyncOS Software for Secure Email Gateway that lets unauthenticated attackers run root-level commands by sending crafted emails with malicious SQL statements. The company confirmed it detected active exploitation of the bug in September 2026 and issued indicators of compromise for defenders to check mail logs and network traffic. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 17 to patch.
GoKawiil's interpretation of the reporting above, not reported fact.
Email gateways sit at the perimeter of enterprise networks, making a root-level remote code execution flaw in one especially dangerous since it can serve as an entry point for deeper network compromise. With over 400 exposed appliances already tracked online and attackers reportedly erasing evidence of intrusion, organizations face both immediate patching pressure and difficulty assessing whether they've already been breached.
- CVE-2026-76461 allows unauthenticated attackers to gain root access via crafted emails exploiting SQL injection flaws.
- CISA's KEV listing forces federal agencies to patch by September 17, signaling the severity of active exploitation.
- Over 400 internet-exposed Secure Email Gateway appliances remain at risk, with attackers potentially covering their tracks.
Source: bleepingcomputer.com, 2026-09-15
Published there as: “Cisco patches Secure Email Gateway zero-day exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.