Vulnerabilities
Cisco Secure Email Gateway Vulnerability Enables Remote Root Execution
A critical flaw (CVE-2026-76461) in Cisco AsyncOS Email Gateway allows unauthenticated remote attackers to execute commands as root. The issue stems from insufficient email parsing validation and is actively exploited. Defenders should patch immediately and monitor for anomalous activity.
What Happened
Cisco disclosed that a flaw in the AsyncOS software of its Secure Email Gateway permits unauthenticated remote attackers to run arbitrary commands with root privileges. The vulnerability, identified as CVE-2026-76461, has a CVSS score of 9.8 and is currently being exploited in the wild.
Impact
Successful exploitation grants full control over the affected gateway, enabling attackers to modify email filtering rules, exfiltrate data, or pivot to internal networks. The flaw affects all versions of AsyncOS that host the Secure Email Gateway component.
Mitigation Steps
- Apply the latest Cisco AsyncOS patch or upgrade to a version that includes the fix.
- Revoke and reissue any compromised credentials and review access controls.
- Enable logging and monitor for unusual outbound connections or command execution patterns.
- Consider network segmentation to isolate the email gateway from critical internal resources.
What to Do Now
Immediately update the affected systems, verify that the patch is in place, and conduct a thorough audit of gateway logs for signs of exploitation. Maintain an incident response plan that includes containment, eradication, and recovery steps specific to email gateway compromise.
Related vulnerabilities
Cisco Secure Email Gateway CVE-2026-76461 Zero-Day Exploited in the Wild
Cisco has patched a critical SQL injection vulnerability, tracked as CVE-2026-76461, in the AsyncOS software used by Cisco Secure Email Gateway. The flaw allows unauthenticated, remote attackers to achieve root-level command execution via crafted emails and is actively exploited in the wild. SecOps and sysadmins must immediately apply the vendor-supplied firmware updates.
Read briefing
Critical SQL Injection in Cisco Secure Email Gateway Grants Root Access
A new flaw in Cisco’s AsyncOS email parsing logic lets unauthenticated attackers send a crafted message that injects SQL, triggering arbitrary commands with root privileges on the host. The vulnerability, CVE‑2026‑76461, is critical and has no workaround—only a patch. Cisco has released updates; systems must upgrade immediately to avoid a full compromise.
Read briefing
Cisco Secure Email Gateway & AsyncOS: Multi‑Vulnerability Alert – RCE, DoS, SQLi
A wave of security flaws has been uncovered across Cisco’s Secure Email Gateway, Secure Email and Web Manager, and AsyncOS platforms. Several of the bugs enable attackers to execute arbitrary code remotely, crash the system, and inject malicious SQL statements. Cisco’s CVE‑2026‑76461 is already being actively exploited. Immediate patching is mandatory for all affected versions, and network operators should verify that hardening guidelines are in place.
Read briefing
Kemp LoadMaster Uninitialized Memory RCE - CVE-2026-8037
Progress Software’s Kemp LoadMaster is vulnerable to a remote code execution flaw in the escape_quotes function. The issue requires authentication and allows attackers to run code as root. Apply the vendor patch immediately and verify configuration hardening.
Read briefing