Cisco patches Secure Email Gateway zero-day exploited in attacks
Read original article ↗AI Summary
Cisco has patched a critical zero-day vulnerability, CVE-2026-76461, in its Secure Email Gateway (SEG) software that was actively exploited by threat actors. The flaw resides in the email parsing logic of Cisco AsyncOS and allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to root-level command execution on the underlying operating system. Exploitation occurs by sending a specially crafted email containing malicious SQL statements. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within three days.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.