Cisco Secure Email Gateway zero-day actively exploited with root privileges

Cisco has fixed CVE-2026-76461, a critical vulnerability with a CVSS score of 9.8 affecting Secure Email Gateway that is already being exploited in real-world attacks. The flaw stems from insufficient validation in AsyncOS email parsing logic and can be triggered remotely without authentication. An attacker only needs to send a specially crafted message containing malicious SQL instructions to execute operating system commands with root privileges. Versions 16.5, 16.0, 15.5, and earlier installed on affected appliances are impacted, while CISA has added the flaw to its Known Exploited Vulnerabilities catalog. Cisco has released patches and indicators of compromise, making both updates and a retrospective investigation of exposed gateways urgent.

Source: Security Affairs