Cisco CVE-2026-76461 Added to CISA KEV Under Active Exploitation
Key findings • CISA added Cisco CVE-2026-76461 to its KEV catalog on September 14, 2026. • The vulnerability is confirmed to be under active exploitation by threat actors. • Federal agenc…
Key findings
- CISA added Cisco CVE-2026-76461 to its KEV catalog on September 14, 2026.
- The vulnerability is confirmed to be under active exploitation by threat actors.
- Federal agencies must remediate this flaw by March 13, 2027.
- All organizations using affected Cisco products should patch immediately.
CISA has issued an urgent alert by adding a critical Cisco vulnerability, CVE-2026-76461, to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion on September 14, 2026, signifies that the flaw is no longer theoretical but has been actively leveraged by malicious actors in real-world attacks. The addition of any vulnerability to the KEV catalog elevates its status to an immediate and severe threat, demanding prompt attention from all organizations.
CVE-2026-76461, while specific details of its nature are not publicly elaborated beyond its identifier, represents a significant security risk within Cisco's product ecosystem. Its presence in the KEV catalog confirms that threat actors have successfully developed and deployed exploits targeting this vulnerability, making any unpatched systems highly susceptible to compromise. Organizations utilizing affected Cisco products should consider this a direct call to action.
The CISA KEV catalog serves as a definitive list of vulnerabilities that pose a current and significant risk to federal enterprise networks. For federal civilian executive branch (FCEB) agencies, remediation of KEV-listed vulnerabilities is a mandatory requirement, with specific deadlines for compliance. The deadline for CVE-2026-76461 will be March 13, 2027, six months from its addition date.
Beyond federal mandates, the active exploitation status of CVE-2026-76461 means that all organizations, regardless of sector, face an elevated risk. Defenders are strongly advised to identify all instances of affected Cisco products within their environments and apply the necessary patches or mitigations without delay. Prioritizing the remediation of KEV-listed vulnerabilities is a cornerstone of effective cybersecurity posture, as these flaws are proven entry points for adversaries.
Cisco's Secure Email Gateway is now facing active exploitation of a critical zero-day vulnerability, CVE-2026-76461, which allows for root-level remote code execution. The vulnerability, identified as an email parsing flaw in AsyncOS software, has a CVSS score of 9.8 and is being exploited without authentication. Cisco has released indicators of compromise, though it notes that threat actors can obscure these by obtaining root privileges.
Cisco has released patches for CVE-2026-76461, a zero-day SQL injection vulnerability affecting its Secure Email Gateway appliances. The vulnerability, present in AsyncOS Software versions 16.5, 16.0, and 15.5 and earlier, was actively exploited in the wild. Cisco confirmed the exploitation and provided indicators of compromise for affected organizations, recommending upgrades to fixed releases 15.5.5-014, 16.0.4-302, or 16.5.0-780.
The Rapid7 article provides further technical details on CVE-2026-76461, including the CVSS score of 9.8 and the method of exploitation via a specially crafted email. It also highlights that the vulnerability allows for unauthenticated remote attackers to execute arbitrary commands with root privileges on affected appliances, and notes the absence of public proof-of-concept exploit code at the time of publication.
The article provides further details on the critical SQL injection vulnerability (CVE-2026-76461) affecting Cisco Secure Email Gateway's AsyncOS software, emphasizing its addition to CISA's Known Exploited Vulnerabilities catalog. It highlights that unauthenticated remote attackers can exploit this flaw to execute arbitrary commands with root privileges, leading to full appliance control, and urges immediate application of vendor mitigations due to active exploitation.
The Register article provides further technical details on the exploitation of CVE-2026-76461, noting that the vulnerability lies within Cisco's AsyncOS software's handling of incoming emails. It also highlights that Cisco discovered the flaw while resolving a Technical Assistance Center support case and that active exploitation was observed in September. The article further details Cisco's remediation efforts for its cloud customers and provides drastic recovery advice for compromised virtual appliances, including preserving forensic evidence and deploying fresh VMs.
The new article from CyberScoop provides additional context on the active exploitation of Cisco's Secure Email Gateway zero-day, CVE-2026-76461. It details how attackers can gain root privileges, effectively taking full control of the gateway, and notes that Cisco has directly contacted customers where compromise indicators were found. The report also highlights the potential for attackers to pivot internally if the appliance is deployed on-premises, and that attackers may attempt to hide their tracks.
This new report confirms that CVE-2026-76460, an authentication bypass vulnerability in an API of Cisco Identity Services Engine (ISE), is actively being exploited by unauthenticated attackers. The vulnerability allows bypassing the management interface of the ISE platform, which is critical for network access control and policy enforcement.