Critical Cisco Secure Email Gateway zero-day gives attackers root access

Cisco released emergency patches for a critical vulnerability in its Secure Email Gateway appliance that could allow attackers to take over the device by simply sending malicious crafted emails to users.

The short version

• The flaw was already being exploited in the wild when the fixes were released.
• Tracked as CVE-2026-76461, the vulnerability is described by Cisco as an SQL injection caused by insufficient validation in the product’s email parsing code.
• Parsing incoming email messages for threats is this appliance’s main job, which means the attack vector is trivial.

What happened

“An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device,” Cisco said in its advisory . The Cisco product security team became aware of active exploitation of this vulnerability earlier this month, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog .

Why it matters

Indicators of compromise might be missing Because the vulnerability has been exploited as a zero-day, just upgrading to the patched firmware version is not enough.

Summary by Nerd News Network. Read the full article at Network World via the links above and below.