CVE-2026-76461: Critical Cisco Secure Email Gateway Zero-Day Enables Root RCE

Cisco patched CVE-2026-76461, a critical SQL injection in AsyncOS for Secure Email Gateway that allows unauthenticated remote attackers to execute arbitrary commands as root by sending specially crafted emails; exploitation was confirmed in the wild in September 2026, the flaw scores CVSS 9.8, and Cisco and CISA required remediation. Cisco released fixed AsyncOS versions (recommended 16.5.0-780), warned there are no complete workarounds, and advised immediate upgrades, log review for malicious SQL patterns, external telemetry correlation, forensic preservation for suspected compromises, credential rotation, and rebuilding affected virtual appliances where necessary.