Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation
September 15, 2026 · Sophos Threat Research · Severity: HIGH
Cisco has issued an urgent security advisory regarding CVE-2026-76461, a critical zero-day vulnerability affecting Secure Email Gateway (SEG) appliances that is now being actively exploited in attacks. The flaw, which carries a maximum CVSS severity rating, allows an unauthenticated attacker to remotely compromise affected devices without user interaction. Cisco confirmed that proof-of-concept exploit code is publicly available and threat actors have been observed leveraging this vulnerability in the wild. Organizations using Cisco SEG appliances are urged to apply the available patch immediately and monitor for indicators of compromise, including unauthorized configuration changes and unusual outbound network traffic from the email gateway.
Key Takeaways
- CVE-2026-76461 affecting Cisco Secure Email Gateway is under active exploitation in the wild, prompting urgent patching recommendations for all affected deployments.
- Cisco has released security advisories addressing the vulnerability, which could allow attackers to compromise email gateway security and intercept organizational communications.
- Organizations using Cisco Secure Email Gateway should prioritize applying available patches and monitoring for signs of compromise related to this vulnerability.