Cisco confirmed active exploitation of a root email flaw. Federal agencies got three days.
BleepingComputer reported active exploitation of CVE-2026-76461, affecting Cisco Secure Email Gateway, on 15 September.
Cisco's advisory traces the flaw to "insufficient validation in the email parsing logic". An attacker sends "a crafted email message that contains malicious SQL statements through an affected device".
Cisco says a successful exploit could allow an attacker to "execute arbitrary SQL statements, leading to command execution with root privileges". Cisco says that "in September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability".
CISA added the flaw to its Known Exploited Vulnerabilities catalog on Monday and gave federal agencies until 17 September to patch. That is a three-day window.
Shadowserver tracks more than 400 Secure Email Gateway appliances exposed online.
Cisco tells administrators to check mail_logs for suspicious SQL statements. It also advises cross-referencing network and firewall logs, because root access means the appliance's own logs can be edited.
When your mail gateway gets breached, which log do you trust?
Sources
Our file on Cisco
- 1 Oct
Pfizer certified 98% of its staff in AI. Its CIO says resistance fell.
- 27 Sept
Cisco's CEO said firms could perhaps run with 20% fewer people. He prefers growth.
Every story here is open to read. The ERP LEADERS brief goes one step further.
The day in enterprise software, in one email: the stories that matter, the failures with their figures, one case taken apart. Read a sample or sign up for the brief.
Welcome back. · Issue 01
