Cisco Secure Email Gateway: critical vulnerability actively exploited to gain root privileges

Cisco has fixed CVE-2026-76461, a critical vulnerability in Secure Email Gateway's email parsing that is already being actively exploited. An unauthenticated remote attacker can send a specially crafted message containing SQL instructions, execute arbitrary queries, and ultimately execute commands with root privileges on the underlying operating system. The issue affects Cisco AsyncOS and stems from insufficient validation of content processed by the gateway, a device located in a particularly sensitive position within the corporate infrastructure. Cisco has also released a broader hardening update for Secure Email Gateway and Secure Email and Web Manager, fixing six vulnerabilities, five of which are classified as critical. No effective workarounds are available, so Cisco and ACN-CSIRT Italia recommend installing the updates immediately and checking for anomalous emails, unexpected commands, or other signs of compromise.

Source: Cisco Security Advisories