Cisco says email-gateway zero-day was exploited before patch

Cisco disclosed and patched CVE-2026-76461, a critical zero-day in Cisco Secure Email Gateway that it says was exploited before disclosure. The flaw affects Cisco AsyncOS Software and lets unauthenticated remote attackers execute commands with root privileges on vulnerable systems. Cisco said it contacted Cisco Secure Email Cloud customers where it identified possible compromise indicators and deployed mitigations within its managed environment. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Cisco released indicators of compromise, though attackers may be able to hide or remove traces.