Reported by 23 outlets

Timeline

1. original reporting

   CVE-2026-76461: Critical Cisco Secure Email Gateway Zero-Day Enables Root RCE

   socprime.com · 28d ago · September 15th, 2026

   Cisco has patched CVE-2026-76461, a critical zero-day vulnerability in Secure Email Gateway appliances that is already being exploited in the wild. The flaw carries a CVSS score of 9.8 and enables an unauthenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system simply by sending a specially crafted email through a vulnerable device. The vulnerability resides in the email parsing logic of Cisco AsyncOS Software. Insufficient validation allows a malicious email to contain SQL statements that are processed by the gateway, resulting in arbitrary SQL execution and, ultimately, operating system command execution as root. Because exploitation requires neither authentication nor user interaction, vulnerable internet-facing email security infrastructure represents a particularly attractive target. The disclosure adds another actively exploited vulnerability to the rapidly growing zero-day landscape. Cisco PSIRT became aware of attacks exploiting the flaw in September 2026, while CISA added it to the Known Exploited Vulnerabilities catalog and required US federal civilian agencies to remediate affected systems by September 17, 2026. Security teams looking for CVE-2026-76461 detection content can leverage SOC Prime’s AI-Native Detection Intelligence Platform to identify exploitation patterns and related post-compromise activity. Click Explore Detections to access relevant detection rules and hunting queries mapped to MITRE ATT&CK®

2. update from sec.cloudapps.cisco.com

   ayy lmao Cisco CVE-2026-76461 A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an u

   sec.cloudapps.cisco.com · 29d ago · September 14th, 2026

   ayy lmao Cisco CVE-2026-76461 A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an u

   via Mastodon https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

3. mentioned by sec.cloudapps.cisco.com

   Welcome to Monday and two new advisories from Cisco. CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gatewa

   sec.cloudapps.cisco.com · 29d ago · September 14th, 2026

4. update from malware.news

   Cisco security advisory (AV26-921)

   malware.news · 29d ago · September 14th, 2026

   Serial Number: AV26-921 Date: September 14, 2026 As of September 14, 2026, Cisco is affected by vulnerabilities in the following products: Cisco AsyncOS for Cisco Secure Email Gateway Prior to 15.5.5-014 Prior to 16.0.4-302 Prior to 16.5.0-780 Cisco Secure Email Gateway Prior to 15.5.5-014 Prior to 16.5.0-780 Cisco Secure Email and Web Manager Prior to 15.5.5-006 Prior to 16.5.0-429 On September 14, 2026, Cisco stated that CVE-2026-76461 is being actively exploited. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

5. update from secdb.nttzen.cloud

   🚨 [CISA-2026:0914] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:

   secdb.nttzen.cloud · 29d ago · September 14th, 2026

   🚨 [CISA-2026:0914] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:

   via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0914

6. update from www.cisa.gov

   Since no one seems to have noticed the Cisco exploited zero-day: CISA has added one new vulnerability to its Known Exploited Vulnerabilities

   www.cisa.gov · 29d ago · September 14th, 2026

   Since no one seems to have noticed the Cisco exploited zero-day: CISA has added one new vulnerability to its Known Exploited Vulnerabilities

   via Mastodon https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog

7. mentioned by securityonline.info

   CVE-2026-76461 (CVSS 9.8) is a Cisco Secure Email Gateway vulnerability exploited in the wild. SQL injection grants root command execution.

   securityonline.info · 29d ago · September 15th, 2026

8. mentioned by securityonline.info

   Cisco patched critical Cisco Secure Email vulnerabilities. Update to fix Cisco Secure Email vulnerabilities and prevent unauthorized system

   securityonline.info · 29d ago · September 15th, 2026

9. update from cyberpress.org

   Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root

   cyberpress.org · 29d ago · September 15th, 2026

   That access level makes the issue particularly severe for an internet-facing mail security appliance: an intruder could potentially alter the appliance, steal data available to it, establish persistence, or use it as a foothold for further activity. The vulnerable scope includes physical and virtual Cisco Secure Email Gateway deployments, regardless of configuration. The vendor has released patches for AsyncOS 15.5 and earlier in version 15.5.5-0141, for version 16.0 in 16.0.4-3021, and for 16.5 in 16.5.0-780. Cisco strongly recommends migrating to 16.5.0-780. Its cloud service fleet has already been upgraded to that release, while Cisco has contacted Secure Email Cloud customers

10. update from gbhackers.com

    Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root

    gbhackers.com · 29d ago · September 15th, 2026

    This vulnerability can be exploited remotely and without authentication, allowing attackers to execute arbitrary commands with root privileges on affected devices. It […] The post Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

11. mentioned by thehackernews.com

    🤖 CVE-2026-76461 (CVSS 9.8): critical flaw in Cisco Secure Email Gateway (AsyncOS) under active exploitation in the wild. Insufficient valid

    thehackernews.com · 28d ago · September 15th, 2026

12. mentioned by blog.marcfredericgomez.fr

    [VULN] SQL injection exploited in Cisco Secure Email Gateway - CVE-2026-76461

    blog.marcfredericgomez.fr · 28d ago · September 15th, 2026

13. mentioned by www.yazoul.net

    🔴 New security advisory: CVE-2026-76461 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R

    www.yazoul.net · 28d ago · September 15th, 2026

14. update from rapid7.com

    CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

    rapid7.com · 28d ago · September 15th, 2026

    Cisco Secure Email Gateway, formerly known as IronPort Email Security Appliance, is an enterprise email security product that inspects inbound and outbound email for threats including phishing, malware, spam, and business email compromise. Because affected gateways process externally delivered email as part of their normal operation, exploitation does not require access to an administrative interface or authentication. At the time of publication, there is no public proof-of-concept exploit code available, and no attribution for the current threat actor activity. Mitigation guidance Organizations running Cisco Secure Email Gateway should prioritize upgrading to a vendor-supplied fixe

15. update from dev.to

    Cisco Secure Email Gateway CVE-2026-76461: Active Exploitation of Pre-Authentication SQL Injection # security # threatintel # software # cod

    dev.to · 28d ago · September 15th, 2026

    Cisco Secure Email Gateway CVE-2026-76461: Active Exploitation of Pre-Authentication SQL Injection # security # threatintel # software # cod

    via Mastodon https://dev.to/anoymask/cisco-secure-email-gateway-cve-2026-76461-active-exploitation-of-pre-authentication-sql-injection-4gha

16. update from cyberscoop.com

    Cisco warns customers of actively exploited zero-day in email gateways

    cyberscoop.com · 28d ago · September 15th, 2026

    Attackers of unknown origins and motivations are exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway, authorities and researchers said Monday. “In practical terms, that gives the attacker control of the gateway itself,” Douglas McKee, director of vulnerability intelligence at Rapid7, told CyberScoop. When asked for further details, a company spokesperson pointed to the advisory and reiterated that the company is aware of active exploitation of the vulnerability. The company did not say how many organizations are impacted for active exploitation thus far, but it indicated multiple customers were likely compromised prior to disclosure. “Cisco has conducted a thorough threat intelligence investigation on devices that belong to Cisco Secure Email Cloud. Cisco has directly contacted customers who own Cisco Secure Email Cloud devices where indicators of possible compromise were identified,” the company wrote in its security advisory. “Cisco is engaged in remediation and recovery operations. Cisco has already deployed mitigations that are within Cisco’s management.” The C

17. mentioned by cyber.netsecops.io

    📰 Cisco Patches Actively Exploited Zero-Day in Secure Email Gateways Cisco patches critical, actively exploited zero-day (CVE-2026-76461) in

    cyber.netsecops.io · 28d ago · September 15th, 2026

18. mentioned by www.yazoul.net

    🔵 THREAT INTELLIGENCE Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution Vulnerability | CRITICAL CVEs: C

    www.yazoul.net · 28d ago · September 15th, 2026

19. mentioned by www.yazoul.net

    🔵 THREAT INTELLIGENCE Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution Vulnerability | CRITICAL CVEs: C

    www.yazoul.net · 28d ago · September 15th, 2026

20. mentioned by threatnoir.com

    ⚠️ CRITICAL: Cisco patches Secure Email Gateway zero-day exploited in attacks Cisco Secure Email Gateway has a critical zero-day (CVE-2026-7

    threatnoir.com · 28d ago · September 16th, 2026

21. mentioned by threatnoir.com

    ⚠️ CRITICAL: Cisco warns customers of actively exploited zero-day in email gateways Cisco Secure Email Gateway contains a critical unauthent

    threatnoir.com · 28d ago · September 16th, 2026

22. mentioned by meterpreter.org

    A critical Cisco Secure Email Gateway vulnerability allows unauthenticated attackers to gain root access via a single email. Learn about CVE

    meterpreter.org · 27d ago · September 16th, 2026

23. mentioned by www.bleepingcomputer.com

    # Cisco patches Secure # Email Gateway zero-day exploited in attacks https://www. bleepingcomputer.com/news/secu rity/new-cisco-secure-email

    www.bleepingcomputer.com · 27d ago · September 16th, 2026

24. mentioned by dev.to

    Cisco Secure Email Gateway: One Crafted Email Gives Root, and It Is Already Being Exploited # cybersecurity # infosec # security # software

    dev.to · 27d ago · September 16th, 2026

25. update from malware.news

    CVE-2026-76461: Cisco Email Gateway Flaw Exploited

    malware.news · 27d ago · September 16th, 2026

    What Is CVE-2026-76461? Unlike vulnerabilities confined to administrative interfaces, this flaw is reachable through the

26. mentioned by cyber.netsecops.io

    📰 Cisco Patches Actively Exploited Zero-Day in Secure Email Gateways Cisco patches critical, actively exploited zero-day (CVE-2026-76461) in

    cyber.netsecops.io · 27d ago · September 16th, 2026

27. mentioned by endoflife.ai

    📖 New from endoflife.ai: Cisco Secure Email Gateway CVE-2026-76461: Root by Email, Due Sep 17 https:// endoflife.ai/article-cisco-sec ure-em

    endoflife.ai · 27d ago · September 16th, 2026

28. update from www.cybersecuritydive.com

    https://www. cybersecuritydive.com/news/hac kers-exploit-zero-day-cisco-email-gateway/830553 # ZeroDay # Cisco # CyberSecurity # Ransomware

    www.cybersecuritydive.com · 27d ago · September 16th, 2026

    cybersecuritydive.com/news/hac kers-exploit-zero-day-cisco-email-gateway/830553 # ZeroDay # Cisco # CyberSecurity # Ransomware

    via Mastodon https://www.cybersecuritydive.com/news/hackers-exploit-zero-day-cisco-email-gateway/830553

29. update from malware.news

    Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild (CVE-2026-76461)

    malware.news · 26d ago · September 17th, 2026

    Recommended Actions Truesec recommends that you upgrade to one of the fixed versions below. If the device is part of a cluster, review the logs of each cluster device.

30. update from www.all-about-security.de

    Cisco patches over 20 security vulnerabilities, critical firewall flaw under active attack

    www.all-about-security.de · 26d ago · September 17th, 2026

    Cisco addressed multiple vulnerabilities across its product line in its latest advisory batch. via Mastodon https://www.all-about-security.de/cisco-schliesst-ueber-20-sicherheitsluecken-kritische-firewall-luecke-wird-bereits-aktiv-angegriffen/

31. mentioned by cybersecurefox.com

    CVE-2026-76461: SQL injection in Cisco Secure Email Gateway 🔗 https:// cybersecurefox.com/en/cve-2026 -76461-cisco-secure-email-gateway-sql-

    cybersecurefox.com · 24d ago · September 19th, 2026