# Cisco Confirms Active Exploitation of Critical Email Gateway Zero-Day Root-level command execution via malicious emails threatens Secure Email Gateway appliances - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/877cb38c-ed3d-4426-b397-05d90514dc1c ## Critical vulnerability disclosed Cisco disclosed CVE-2026-76461, a critical zero-day (CVSS 9.8) in Secure Email Gateway appliances. The flaw allows unauthenticated remote attackers to execute arbitrary commands with root privileges through malicious emails. The vulnerability stems from insufficient validation in AsyncOS email parsing logic, where crafted emails containing SQL statements bypass security checks. ## Active exploitation confirmed Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation of this vulnerability in the wild. The company warns there are no available workarounds, affecting both physical and virtual appliances regardless of configuration. This marks the second major email gateway vulnerability Cisco has disclosed this year, following similar SQL injection risks in March. ## Attack mechanism details Attackers exploit the flaw by sending specially crafted emails containing malicious SQL statements. When processed by vulnerable devices, these statements trigger arbitrary command execution on the underlying operating system with root privileges. The vulnerability affects the core email parsing function in Cisco's AsyncOS software, which processes all incoming messages. ## Detection methods Cisco advises administrators to check mail_logs for suspicious SQL statements, particularly looking for 'COPY.*TO PROGRAM' patterns. For clustered deployments, each device's logs must be reviewed separately. Cloud-based Secure Email Gateway customers may lack direct log access, though Cisco states it has contacted affected cloud customers directly. ## Federal response On September 14, US CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 17. This rapid inclusion reflects the severity of active exploitation. Cisco's advisory provides specific grep commands to help identify exploitation attempts in system logs. ## Vulnerability scope The vulnerability impacts all Cisco Secure Email Gateway appliances running vulnerable AsyncOS versions, with no configuration-based mitigations available. Unlike some previous email gateway flaws, this vulnerability allows direct root access rather than limited privilege escalation, significantly increasing potential damage from successful exploits. ## Enterprise security implications As email gateways typically sit at network perimeters, this vulnerability exposes organizations to complete system compromise. Attackers gaining root access could deploy persistent malware, exfiltrate data, or pivot to internal networks. The SQL injection vector is particularly concerning as it bypasses traditional email security filters. ## Urgent action required Security teams should immediately scan logs for exploitation indicators and apply any available patches. Organizations without in-house expertise should consider engaging incident response services. This vulnerability underscores the growing sophistication of email-based attacks targeting enterprise infrastructure components. ## Sources covering this story - https://securityaffairs.com/199137/hacking/cisco-warns-of-ongoing-exploitation-of-critical-email-gateway-zero-day.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._