CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Zero-Day Under Active Exploitation

CVE-2026-76461 is a critical (CVSS 3.1 9.8) unauthenticated SQL injection in Cisco AsyncOS for Secure Email Gateway that allows an attacker to send a crafted email to achieve root command execution on the appliance; exploitation was confirmed in the wild prior to public disclosure and the vulnerability was added to CISA’s KEV on disclosure day (Sept 14, 2026) with a three-day federal remediation deadline. No workaround exists; fixed releases (recommended target AsyncOS 16.5.0-780) must be deployed, while detection guidance includes grepping mail_logs for the pattern 'COPY.*TO PROGRAM'; clustered deployments require full restoration and credential/SSH key renewal because a compromised node exposes cluster authentication material.