Loading story…
Cisco disclosed active exploitation of CVE-2026-76461, an SQL injection flaw affecting Cisco Secure Email Gateway deployments. The vulnerability affects unpatched releases of Cisco AsyncOS for Cisco Secure Email Gateway, Cisco Secure Email Gateway, and Cisco Secure Email and Web Manager.
CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog, while the Canadian Centre for Cyber Security issued advisory AV26-921. Cisco has released a September 2026 security-hardening update; administrators should identify affected appliances and management systems and apply Cisco’s prescribed fixed releases promptly.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-921 covering CVE-2026-76461 and urging administrators to review Cisco guidance and apply necessary updates.
CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog after active exploitation was reported.
Cisco disclosed that CVE-2026-76461 can be exploited without authentication by sending a crafted email with malicious SQL statements, potentially resulting in root-level operating-system command execution on affected Secure Email Gateway appliances. Cisco released AsyncOS 16.5.0-780 for customer-managed appliances, upgraded Secure Email Cloud devices, and stated that no workaround exists.
Cisco reported that CVE-2026-76461, an SQL injection vulnerability affecting Cisco Secure Email Gateway products, was being actively exploited.
Cisco released a security-hardening update for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcelabs.beazley.security
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco remediated two vulnerabilities in Cisco Secure Email Gateway, led by **CVE-2024-20401**, a critical flaw with a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted email attachment to create root users, modify appliance configuration, execute arbitrary code, or trigger persistent denial of service. Cisco also patched **CVE-2024-20429** (CVSS 6.5), a server-side template injection vulnerability that allows an authenticated operator-level user to execute code remotely as root. Cisco reported no known exploitation when the advisory was issued; organizations should apply the available software updates and Cisco mitigations promptly.
Aug 31, 2026
A critical vulnerability, tracked as CVE-2025-20393, has been identified in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager products running any version of AsyncOS with the Spam Quarantine feature enabled and exposed to the internet. Cisco released a security advisory detailing the flaw and urging administrators to review recommendations and apply necessary updates to mitigate the risk. The vulnerability allows for improper input validation, which could be exploited by malicious actors to compromise affected systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-20393 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. Federal agencies are required to remediate this vulnerability by the specified deadline, and CISA strongly encourages all organizations to prioritize patching to reduce exposure to cyberattacks. The inclusion of this vulnerability in the KEV Catalog highlights its significance as a frequent attack vector and underscores the urgent need for remediation across both public and private sectors.
Jun 29, 2026
Cisco released fixes for a maximum-severity vulnerability in *AsyncOS* (tracked as **CVE-2025-20393**, **CVSS 10.0**) affecting **Cisco Secure Email Gateway (SEG)** and **Secure Email and Web Manager (SEWM)** appliances. Cisco reported the issue was exploited as a zero-day in attacks against a limited subset of internet-exposed appliances, enabling attackers to execute arbitrary commands with **root** privileges on the underlying operating system. The flaw was attributed to insufficient HTTP request validation in the **Spam Quarantine** feature, allowing crafted HTTP requests to trigger root-level command execution. Cisco and Cisco Talos attributed the exploitation activity to **UAT-9686**, described as a China-linked threat group, with activity observed since at least late November 2025 and detected by Cisco on December 10. Cisco stated the intrusions included deployment of a **persistence mechanism** to maintain control over compromised appliances, and indicated that the released software updates both remediate the vulnerability and remove related persistence mechanisms; Cisco urged affected customers to upgrade to fixed releases per the updated advisory.
Jun 29, 2026