Cisco has patched a critical zero-day vulnerability in its Secure Email Gateway (SEG) appliances after confirming that attackers have been actively exploiting it in the wild. The flaw, tracked as CVE-2026-76461, is rooted in how the product parses incoming email: an unauthenticated attacker can send a specially crafted message containing malicious SQL statements, which the appliance processes without adequate validation. A successful exploit lets the attacker execute arbitrary commands with root privileges on the underlying operating system — full control of the device with no credentials required.
The vulnerability affects both virtual and physical Cisco SEG appliances running AsyncOS software, regardless of how the device is configured. Cisco’s Product Security Incident Response Team (PSIRT) confirmed awareness of active exploitation in September 2026 and published a fix the same day as the disclosure. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on Monday and ordered all federal agencies to apply the patch by September 17. On the same day, Cisco also patched four additional critical flaws (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) affecting SEG and Secure Email and Web Manager (SEWM) appliances, though those have not been observed exploited.
How to check if you’re affected
Affected products are all Cisco Secure Email Gateway appliances running AsyncOS versions before the September 15, 2026 security update. Apply the patch immediately using Cisco’s official update mechanism.
To check for signs of compromise, Cisco advises reviewing each cluster device’s mail_logs for suspicious SQL statements. Also examine network and firewall logs for unexpected outbound connections to external IP addresses — attackers may remove direct exploitation evidence, so anomalous traffic is the secondary signal.