[CRITICAL] – Cisco Secure Email Gateway Zero-Day Under Active Exploitation

Key Facts

CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Cisco identifies it as a SQL-injection vulnerability in Secure Email Gateway.

Technical Details

Cisco’s advisory describes an email-parsing flaw in AsyncOS for Secure Email Gateway that can allow an unauthenticated remote attacker to execute commands with root privileges. SecurityWeek reports that physical and virtual Secure Email Gateway appliances are affected.

Impact & Mitigation

Prioritize affected Secure Email Gateway appliances for remediation using Cisco’s advisory. CISA recommends organizations prioritize remediation of KEV vulnerabilities; review Cisco’s published indicators during compromise assessment.

Sources

• CISA KEV announcement
• Cisco security advisory
• SecurityWeek coverage