CiscoAnalysisCisco warns of active zero-day root RCE in Secure Email Gateway AsyncOS
What happened.Cisco published an emergency advisory warning of an actively exploited zero-day command injection flaw affecting Cisco Secure Email Gateway appliances.
Why it matters.Secure Email Gateway appliances filter inbound and outbound email traffic for enterprise communications. When incoming email parsing triggers root remote code execution, unauthenticated attackers compromise corporate email infrastructure and pivot into enterprise networks. Infrastructure teams must apply Cisco AsyncOS maintenance releases immediately. Security operations engineers should inspect mail logs for unauthorized command patterns.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-76461 with a 9.8 CVSS score, the defect stems from improper input validation during email message parsing in AsyncOS.
- Attack vector: Remote unauthenticated attackers send crafted email messages containing malicious database commands directly through targeted appliances.
- Root execution: The injected SQL commands execute with root privileges on the underlying operating system without requiring administrative authentication.
- Exploitation detection: Administrators can audit text mail logs for suspicious COPY TO PROGRAM entries to detect active exploitation attempts.
- Remediation releases: Cisco released AsyncOS maintenance builds 15.5.5-014, 16.0.4-302, and 16.5.0-780, confirming no workarounds exist.