Cisco Secure Email Gateway Flaw Exploited in the Wild

Affected Environment
Cisco Secure Email Gateway and Secure Email and Web Manager, physical and virtual appliances.

Threat Overview
A zero-day SQL injection flaw, CVE-2026-76461, is actively exploited alongside five internally discovered hardening flaws.

Exposure Timeline
Disclosed 15 September 2026; fixed releases available now across all affected AsyncOS software versions.

Attack Surface
Email parsing logic processing inbound messages, reachable by unauthenticated remote attackers over email.

Technical Root Cause
Insufficient validation in email parsing allows malicious SQL statements to reach the underlying database.

Exploitation Pathway
Attacker sends a crafted email containing malicious SQL statements to execute commands with root privileges.