# Cisco Email Gateway Vulnerability Actively Exploited, Enables Root Access Critical flaw in Cisco's email security systems allows remote command execution as root. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a476c7a4-4d1f-4f96-a210-a7f754337277 ## Critical vulnerability in Cisco email security Cisco has warned of active exploitation of a critical vulnerability (CVE-2026-76461) in its Secure Email Gateway software, rated 9.8/10 on the CVSS scale. The flaw stems from insufficient validation in email parsing logic, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. Both physical and virtual instances are affected regardless of configuration, though other Cisco security products remain unaffected. ## Exploitation mechanism Attackers can exploit this vulnerability by sending specially crafted emails containing malicious SQL statements through vulnerable devices. Successful exploitation enables execution of arbitrary SQL commands, ultimately granting root-level access to the underlying operating system. Cisco has observed active exploitation this month and provided indicators of compromise to help identify attacks. ## Detection challenges The root-level access granted by this vulnerability allows threat actors to potentially remove or hide evidence of compromise. Cisco recommends administrators examine network and firewall logs outside affected devices for anomalies like unexpected uploads to external IPs or downloads from malicious addresses. The company has directly notified customers where malicious activity was detected on cloud instances. ## Government response The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog. Federal agencies must patch affected systems by September 17, 2026. This comes amid increased scrutiny of enterprise security following recent large-scale credential attacks targeting Fortinet VPN appliances. ## Recent related attacks Security firm Arctic Wolf recently detected massive credential attacks against internet-facing Fortinet VPNs in late August 2026. Attackers used organization-specific usernames and corporate emails across two sustained waves, generating tens of millions of authentication failures. This suggests access to previously collected identity information rather than generic credential spraying. ## Attack methodology The Fortinet attacks employed targeted username selection including employee names, corporate emails, and administrative accounts specific to victim organizations. In one case, successful VPN authentication from IP 158.94.211[.]14 preceded malicious activity. This precision indicates attackers had prior access to enumerated identity data. ## Patch availability Cisco has released fixes for affected AsyncOS software versions on Secure Email Gateway. No workarounds exist beyond updating to patched versions. The company hasn't disclosed attack scale but warns the root access capability makes this particularly dangerous, as attackers can maintain persistent access while hiding their activity. ## Enterprise security implications These incidents highlight growing sophistication in attacks targeting enterprise security infrastructure. The Cisco vulnerability provides direct root access, while the Fortinet attacks demonstrate precise credential targeting. Together they show attackers combining technical exploits with harvested identity data for maximum impact, requiring enhanced monitoring beyond perimeter defenses. ## Sources covering this story - https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._