Cisco patches Secure Email Gateway zero-day exploited in attacks

An email that hands you root on the appliance that was supposed to be filtering it. That’s CVE-2026-76461 in Cisco Secure Email Gateway: unauthenticated command execution as root via SQL in a crafted message, virtual or physical, whatever your config. Cisco PSIRT confirmed active exploitation, CISA gave federal agencies until September 17 to patch, and Shadowserver counts 400+ exposed to the internet. Worth checking yours today.