Cisco patches Secure Email Gateway zero-day flaw

A crafted email leading to the highest OS privilege

The report identifies CVE-2026-76461 in the email-parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway. It says a crafted email carrying malicious SQL statements can allow an unauthenticated remote attacker to run arbitrary commands as root on affected physical and virtual appliances. Cisco reportedly provided indicators of compromise and advised administrators to examine mail, network, and firewall logs.

The article does not establish how long the flaw was exposed or its prior public status. It describes a newly issued Cisco advisory and remediation action for CVE-2026-76461.

Cisco has issued patches and urged customers to update affected Secure Email Gateway appliances. CISA also added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog, with federal agencies directed to patch by September 17.

The reported parsing flaw in a device handling outside email could lead to control of its underlying OS. The patches and compromise indicators described in the account address both updating devices and checking whether intrusion occurred.