CISA KEV alertCyberSIXT
CISA Warns of Actively Exploited Cisco Email Gateway Flaw
Part of the CVE-2026-76461 story · since 14 Sep
- Mon 14 Sep, 20:32 UTC. CISA, first report. CISA Warns of Actively Exploited Cisco Email Gateway Flaw. Cites a CVE in CISA KEV. This article, 1st of 10.
- Tue 15 Sep, 04:41 UTC. SecurityOnline, its first report on the story. Cisco Email Gateway Flaw Exploited to Gain Root Access via Email. Cites a CVE in CISA KEV.
- Tue 15 Sep, 05:52 UTC. SecurityWeek, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw. Cites a CVE in CISA KEV.
- Tue 15 Sep, 13:13 UTC. Security Affairs, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day. Cites a CVE in CISA KEV.
- Tue 15 Sep, 13:13 UTC. Rapid7, its first report on the story. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely. Cites a CVE in CISA KEV.
- Tue 15 Sep, 21:21 UTC. Security Affairs. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks. Cites a CVE in CISA KEV.
- Wed 16 Sep, 14:51 UTC. SOCRadar, its first report on the story. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw. Cites a CVE in CISA KEV.
- Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
- Wed 14 Oct, 19:26 UTC. The Hacker News, its first report on the story. Cisco Email Gateway Flaw Exploited to Run Commands as Root. Cites a CVE in CISA KEV.
- Thu 15 Oct, 07:01 UTC. SecurityWeek. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access. Cites a CVE in CISA KEV.
CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 September 2026. The vulnerability affects Cisco Secure Email Gateway and is known as the Cisco Secure Email Gateway SQL Injection Vulnerability. It could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
The flaw exists in Cisco AsyncOS software for Cisco Secure Email Gateway and is a SQL injection vulnerability. An attacker can exploit it remotely without authentication, potentially gaining root-level control of the host operating system. The vulnerability has a CVSS score of 9.8 and is rated Critical. The available data does not confirm whether a patch is available; patch status is listed as unknown.
CISA’s KEV listing confirms active exploitation. The available information does not establish use in ransomware campaigns. Federal Civilian Executive Branch (FCEB) agencies must remediate the vulnerability by 17 September 2026. Organisations should treat internet-exposed Secure Email Gateway systems as a priority for investigation and response.
CISA requires organisations to apply mitigations in accordance with Cisco’s instructions, while following CISA’s BOD 26-04 guidance on prioritising security updates based on risk and its Forensics Triage Requirements. Organisations must follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. FCEB agencies are directly affected, but all organisations should review their exposure, asset internet accessibility and patching status.
See the NVD entry and CISA KEV catalogue for full details.
How the story developed
10 articles from 7 outlets since 14 Sep. Quiet since 15 Oct. This was the first report.
- Mon 14 Sep, 20:32 UTC. CISA, first report. CISA Warns of Actively Exploited Cisco Email Gateway Flaw. Cites a CVE in CISA KEV. This article, 1st of 10.
- Tue 15 Sep, 04:41 UTC. SecurityOnline, its first report on the story. Cisco Email Gateway Flaw Exploited to Gain Root Access via Email. Cites a CVE in CISA KEV.
- Tue 15 Sep, 05:52 UTC. SecurityWeek, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw. Cites a CVE in CISA KEV.
- Tue 15 Sep, 13:13 UTC. Security Affairs, its first report on the story. Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day. Cites a CVE in CISA KEV.
- Tue 15 Sep, 13:13 UTC. Rapid7, its first report on the story. Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely. Cites a CVE in CISA KEV.
- Tue 15 Sep, 21:21 UTC. Security Affairs. CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks. Cites a CVE in CISA KEV.
- Wed 16 Sep, 14:51 UTC. SOCRadar, its first report on the story. Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw. Cites a CVE in CISA KEV.
- Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
- Wed 14 Oct, 19:26 UTC. The Hacker News, its first report on the story. Cisco Email Gateway Flaw Exploited to Run Commands as Root. Cites a CVE in CISA KEV.
- Thu 15 Oct, 07:01 UTC. SecurityWeek. Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 10 articles as a listHide the list
- Mon 14 SepDay 01
- CISA Warns of Actively Exploited Cisco Email Gateway Flaw20:32 · CISA · official · First report · CISA alert · Known exploited CVE · This article, 1st of 10
- Tue 15 SepDay 15
- Cisco Email Gateway Flaw Exploited to Gain Root Access via Email04:41 · SecurityOnline · Known exploited CVE
- Cisco Secure Email Gateways Hit by Actively Exploited Root Flaw05:52 · SecurityWeek · Known exploited CVE
- Cisco Secure Email Gateways Hit by Actively Exploited Root Access Zero Day13:13 · Security Affairs · Known exploited CVE
Show 2 more from 15 Sep
- Cisco Email Gateway Zero Day Let Attackers Gain Root Access Remotely13:13 · Rapid7 · Known exploited CVE
- CISA Flags Critical Cisco Email Gateway Flaw Exploited in Attacks21:21 · Security Affairs · Known exploited CVE
- Wed 16 SepDay 21
- Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw14:51 · SOCRadar · Known exploited CVE
Quiet for 5 days
Mon 21 SepDay 71- Cisco Warns of Actively Exploited Flaws Enabling Root Access02:59 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 3 weeks
Wed 14 OctDay 301- Cisco Email Gateway Flaw Exploited to Run Commands as Root19:26 · The Hacker News · Picked up again · Known exploited CVE
- Thu 15 OctDay 311
- Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access07:01 · SecurityWeek · Known exploited CVE