Cisco Patches Secure Email Gateway Zero-Day Under Attack

Cisco's security advisory cisco-sa-esa-inj-2bLVGmhX, first published 14 September 2026, says an email-parsing flaw in AsyncOS for Secure Email Gateway lets an unauthenticated remote attacker run arbitrary commands as root. The hole is CVE-2026-76461, scored CVSS 9.8.

SecurityWeek reported that CISA added the bug to its Known Exploited Vulnerabilities catalog. Cisco PSIRT became aware of exploitation in September 2026 and has not named an attacker.

The path is a crafted email that carries malicious SQL statements through an affected device. Physical and virtual Secure Email Gateway appliances are in scope in any configuration. Secure Email and Web Manager and Secure Web Appliance are not.

There are no workarounds. The fixed AsyncOS builds are 15.5.5-014 for 15.5 and earlier, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5. Cisco strongly recommends migrating to 16.5.0-780. Cisco has already upgraded all Secure Email Cloud devices to that build.

To look for attempted exploitation, Cisco points operators at mail_logs for suspicious SQL, including the example pattern COPY.*TO PROGRAM. Root access can wipe those indicators, so an empty grep is not proof a box is clean. Cross-check network and firewall logs off the appliance.

CISA added CVE-2026-76461 to KEV on Monday. Federal agencies are due by September 17. The listing is only the second Cisco Secure Email Gateway vulnerability in KEV, after CVE-2025-20393, which China-linked actors started exploiting in late 2025.

SecurityWeek also notes CVE-2026-76461 is one of several flaws Cisco found internally in Secure Email Gateway and Secure Email and Web Manager.

Some offers on this page may be paid placements or contain affiliate links.