Cisco is urging administrators to patch CVE-2026-76461, a critical zero-day in Cisco AsyncOS Software for Cisco Secure Email Gateway seen in active exploitation during September 2026. The flaw allows unauthenticated remote attackers to run arbitrary operating-system commands as root after an appliance processes a malicious message. CISA placed the issue in its Known Exploited Vulnerabilities (KEV) Catalog on Monday, with a federal remediation deadline of September 17.

How the attack works

Cisco PSIRT said it learned of live abuse in September 2026, as described in its Monday security advisory. See also the NVD entry.

The weakness sits in the mail-parsing routine for Cisco AsyncOS Software for Cisco Secure Email Gateway. It affects both virtual and physical appliances, regardless of the device configuration.

Cisco attributes the problem to inadequate validation in that parsing path. A remote actor without credentials can transmit a specially formed email embedding hostile SQL through a vulnerable system. Successful handling of that input lets the sender run arbitrary SQL statements, which then leads to command execution with root privileges on the underlying operating system.

Detection and mitigation

The vendor published indicators of compromise and recommends reviewing each cluster member's mail_logs for anomalous SQL statements.

Because traces in mail logs can be deleted, Cisco also tells defenders to examine network and firewall telemetry for abnormal behavior, including uploads and downloads to and from external or malicious IP addresses.

Internet monitor Shadowserver currently tracks over 400 Cisco Secure Email Gateway appliances exposed online, without stating how many are honeypots or already remediated. Federal agencies were ordered to remediate under the CISA alert and KEV listing within three days, by September 17. Cisco also publishes a hardening advisory for Secure Email products.

Patch scope and related activity

On Monday, Cisco also fixed four other critical issues — CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443 — affecting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances regardless of configuration. The company said it had no evidence they have also been exploited in the wild.

That follows a January fix for CVE-2025-20393, a maximum-severity Cisco AsyncOS flaw exploited in zero-day attacks against SEG and SEWM devices since November 2025.

More recently, Cisco reported that three separate ransomware and state-sponsored threat groups have exploited two recently patched Secure Firewall Management Center (FMC) flaws. Since November 2021, CISA has flagged 98 Cisco vulnerabilities as actively exploited in attacks, including seven abused by ransomware gangs.

Technical background

This section describes the vulnerability class in general terms, not specifics of this incident. SQL injection happens when application code builds database queries from untrusted input without strict validation or parameterized queries. Attackers can then break out of the intended data context and add their own database instructions. In some architectures, database-level access can be escalated further to operating-system commands if the database account or linked procedures hold excessive privileges or expose system functions.