CVE-2026-76461 Zero-Day Grants Root RCE on Cisco Secure Email Gateway via Email SQL Injection

The vulnerability permits attackers to inject malicious SQL statements through specially crafted emails, achieving root-level OS command execution without authentication. Cisco PSIRT detected exploitation in September 2026 and released IoCs, yet noted that root access allows complete log and artifact removal. Both physical and virtual appliances are affected in every configuration; Secure Email and Web Manager and Secure Web Appliance remain unaffected.

CISA added the flaw to its KEV catalog on the same day, ordering federal agencies to remediate by 17 September. This marks only the second Secure Email Gateway entry in KEV, following CVE-2025-20393 exploited by China-linked actors in late 2025. Days earlier, Cisco and CISA warned of separate FMC flaws CVE-2026-20079 and CVE-2026-20316 used by Russian state actors and cybercriminals.

Procurement records and prior incident reports show repeated AsyncOS parsing weaknesses that bypass standard email filters. Root compromise enables persistent access and lateral movement into mail infrastructure used by government and critical sector organizations. The absence of independent technical attribution leaves open whether the current campaign overlaps with known state or criminal tooling.

Federal agencies must prioritize patching before the CISA deadline; unpatched appliances face high risk of undetected persistence. Watch for follow-on exploitation of related AsyncOS components and cross-check internal logs against the released IoCs before root-level cleanup occurs.