Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited

• •CVE-2026-76461 allows unauthenticated remote code execution on Cisco Secure Email Gateway.
• •Active exploitation confirmed; CISA added it to the KEV catalog on September 14, 2026.
• •Immediate patching is required as no workarounds exist for this critical vulnerability.

On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed that active exploitation of this flaw is occurring, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability affects both physical and virtual versions of Cisco Secure Email Gateway across multiple software release lines. Cisco has released patches for affected versions, but no workarounds are available. Organizations are urged to prioritize patching due to the critical nature of the vulnerability and the potential for significant impact on email security systems.