If your organization runs Cisco networking or security appliances, and most mid-size and large organizations run at least some, this week deserves your attention. Cisco disclosed two separate, maximum-severity vulnerabilities within roughly 48 hours of each other, and confirmed that both are already being exploited by attackers in the real world.
The first, CVE-2026-76461, affects Cisco Secure Email Gateway and allows an attacker to gain full administrative (root) control of the device simply by sending it a specially crafted email. No account, no login, no user having to click anything. The second, CVE-2026-76460, affects Cisco Identity Services Engine (ISE), the system many organizations use to control who and what is allowed onto their network. It lets an attacker walk straight past the login screen and, from there, potentially take root control of that system too.
In plain terms: two pieces of infrastructure that many organizations rely on to protect their networks have holes in them right now that require no password and no user mistake to exploit, and real attackers are already using at least one of them, with the other confirmed under active exploitation as well. Both vendors' fixes are out. The rest of this article explains what each flaw is, who is affected, and exactly what your team should do this week.
Two flaws, one busy week for Cisco admins
Cisco published a security advisory for CVE-2026-76461 on Monday, September 14, 2026, confirming active exploitation of the flaw in Secure Email Gateway appliances. Cisco's Product Security Incident Response Team (PSIRT) said it became aware of exploitation this month and has since worked with affected customers, including directly contacting owners of Cisco Secure Email Cloud devices where malicious activity was detected.
Two days later, on Wednesday, September 16, 2026, Cisco published a much larger batch of advisories, 77 new CVEs in total, the bulk of them affecting ISE and the Secure Firewall product line. Sitting at the top of that batch was CVE-2026-76460, a perfect 10.0 CVSS authentication bypass in ISE that Cisco also confirmed was under active exploitation. Cisco said it discovered this flaw while working a Technical Assistance Center support case, rather than through a researcher disclosure, and has not said publicly who is behind the attacks or how long they had been underway before discovery.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog within days of Cisco's advisories, giving federal civilian agencies a September 17 deadline for CVE-2026-76461 and a September 19 deadline for CVE-2026-76460. Those deadlines are useful benchmarks for any organization, not just federal agencies: if the U.S. government considers these urgent enough to mandate a same-week fix, that is a reasonable bar for your own environment too.
CVE-2026-76461: Cisco Secure Email Gateway, root from an email
What is it?
CVE-2026-76461 carries a CVSS score of 9.8 out of 10.0. It is a SQL injection flaw in the email parsing logic of Cisco's AsyncOS software, the operating system that runs on Secure Email Gateway appliances, both physical and virtual.
Cisco describes the mechanism plainly: an attacker sends a crafted email message containing malicious SQL statements through an affected device. Because the parsing logic does not validate that input properly, those SQL statements get executed, and from there the attacker can pivot to executing arbitrary commands with root privileges on the underlying operating system.
No authentication is required. No user interaction is required. The email itself is the delivery mechanism, and the target does not need to open or read anything for the attack to succeed; the device processes the email automatically as part of its normal function.
Who is affected?
The flaw affects Cisco Secure Email Gateway, on-premises physical and virtual appliances, running AsyncOS versions 15.5 and earlier, 16.0, and 16.5, regardless of how the device is configured. Cisco's cloud-delivered offering, Secure Email Cloud, was also affected; Cisco has already upgraded all of those devices on its side and has directly reached out to customers where it detected malicious activity.
Cisco Secure Email and Web Manager and Cisco Secure Web Appliance are not affected by this specific flaw.
| Product | Affected Versions | Fixed In |
|---|---|---|
| Cisco Secure Email Gateway (AsyncOS) | 15.5 and earlier | 15.5.5-0141 |
| Cisco Secure Email Gateway (AsyncOS) | 16.0 | 16.0.4-302 |
| Cisco Secure Email Gateway (AsyncOS) | 16.5 | 16.5.0-780 (preferred) |
| Cisco Secure Email Cloud | All | Already upgraded by Cisco |
The 15.5.5-0141 and 16.5.0-780 releases are also hardening releases; they include fixes for a slew of additional critical vulnerabilities that Cisco disclosed at the same time, so upgrading to one of them clears more than just this one issue.
What should you do?
1. Check your version and upgrade. There is no workaround for this flaw other than moving to a fixed release. If you run any on-premises Secure Email Gateway appliance, plan the upgrade now rather than at the next scheduled window.
2. Check your logs for signs of prior exploitation. Cisco recommends reviewing mail_logs for suspicious SQL statements. The company provided this command as a starting point:
grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]
If the device is part of a cluster, check the logs on every node in that cluster, not just one.
3. Look outside the device too. Because successful exploitation grants root access, Cisco warns that attackers may delete or hide the evidence of their own intrusion on the device itself. Cross-check network and firewall logs that sit outside the affected device for unexpected uploads to external IP addresses or downloads from suspicious ones.
4. If you find evidence of compromise, do not just patch and move on. Cisco recommends contacting the Technical Assistance Center for physical devices. For virtual appliances, the recommended path is to preserve forensic evidence, stand up a fresh virtual machine on a fixed release, rebuild the configuration from scratch rather than restoring a potentially tainted backup, rotate any credentials and cryptographic material stored on the appliance, and continue monitoring afterward.
CVE-2026-76460: Cisco ISE, a perfect 10 authentication bypass
What is it?
CVE-2026-76460 carries the maximum possible CVSS score, 10.0. It affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), the systems many organizations use as their network access control layer, deciding which devices and users are allowed onto the network and under what conditions.
The cause is insufficient authentication control on an API endpoint. An attacker sends a crafted request to that endpoint and, because the authentication check that should gate access to it is inadequate, gains unauthorized access to the device by bypassing its web-based management interface entirely. As with the email gateway flaw, this requires no valid credentials and no prior access.
Cisco has been direct about the consequences: successful exploitation may allow an attacker to obtain command execution with root privileges. Given that level of access, the company again warns that evidence of exploitation and indicators of compromise may be removed or hidden by whoever exploited it, so a clean-looking log after the fact does not necessarily mean nothing happened.
Who is affected?
The flaw affects ISE and ISE-PIC regardless of device configuration.
| Product | Affected Versions | Fixed In |
|---|---|---|
| Cisco ISE / ISE-PIC | 3.1 | 3.1 Patch 12 |
| Cisco ISE / ISE-PIC | 3.2 | 3.2 Patch 11 |
| Cisco ISE / ISE-PIC | 3.3 | 3.3 Patch 12 |
| Cisco ISE / ISE-PIC | 3.4 | 3.4 Patch 7 |
| Cisco ISE / ISE-PIC | 3.5 | 3.5 Patch 4 |
| Cisco ISE / ISE-PIC | 3.0 | End of software maintenance; migrate to a supported release |
There is no software workaround for this flaw. As an interim mitigation while patching is scheduled, Cisco suggests using infrastructure access control lists (iACLs) to restrict which management and control-plane traffic is allowed to reach the device in the first place, reducing the number of parties who can even attempt to reach the vulnerable endpoint.
What should you do?
1. Patch to a fixed release. Given the CVSS 10.0 score, confirmed active exploitation, and the fact that ISE typically sits at the center of network access decisions, this should move to the top of the queue.
2. Review access logs for suspicious usernames. Cisco's recommended check is:
show logging application ise-kong/access.log | include dummyuser
If you run a distributed deployment, review the logs on every node individually; a compromise on one node will not necessarily show up in another's logs.
3. If you find suspicious activity, Cisco's recommendation is direct: reimage. The company "strongly recommends" reimaging affected nodes and restoring configuration from backup, given that root-level compromise means the operating system itself cannot be trusted to accurately report its own state.
4. Apply iACLs now, even after you patch. Restricting management-plane access to only the systems and administrators that genuinely need it is good practice independent of this specific vulnerability, and it reduces your exposure window while patches are being rolled out across a fleet.
The bigger picture: a large hardening batch alongside these two
The Wednesday advisory batch that included CVE-2026-76460 was unusually large: 77 new CVEs in total, with 41 affecting ISE and 28 affecting the Secure Firewall portfolio (ASA, Threat Defense, and Firewall Management Center). Cisco described some of these as part of an ongoing internal hardening review rather than responses to external researcher reports.
None of the other 76 vulnerabilities in that batch have been confirmed as actively exploited at this time. However, several carry CVSS scores of 9.8 or higher and, taken together, they represent multiple additional paths to command execution, SQL injection, or authentication bypass across ISE and the Firewall product lines. A few worth flagging for teams running the affected products:
- Multiple ISE vulnerabilities allowing an authenticated attacker with valid admin credentials to run arbitrary commands as root (several rated 9.1 to 9.9).
- A set of ISE and ISE-PIC flaws that could allow REST API authentication bypass, remote code execution, SQL injection, and XML External Entity (XXE) attacks, one of which also carries a 10.0 score.
- Firewall Management Center flaws that could allow root access, session forgery, or arbitrary command execution as root, including one reachable without authentication.
If your organization runs ISE or the Secure Firewall product line at any scale, this is a good moment to schedule a broader patch cycle rather than treating CVE-2026-76460 as an isolated fix. Upgrading to the patched releases addresses the confirmed-exploited flaw and closes off a substantial number of adjacent paths at the same time.
Why these two together matter
It is worth pausing on why these two specific systems being hit in the same week is more than a coincidence of bad timing.
Secure Email Gateway sits at the front door of your organization's inbound communications; it is designed to process email from the outside world by definition, which is exactly what makes an unauthenticated, email-triggered exploit so serious. ISE, by contrast, sits at the center of your internal network, deciding what is allowed to talk to what. An attacker who can compromise either one has a meaningful foothold: root on an email gateway offers a platform for further attacks against everyone the organization emails or receives email from, while an authentication bypass on ISE offers a platform for undermining the access controls that the rest of your network security posture depends on.
Neither vulnerability requires the attacker to have done anything clever beforehand. No phishing email needs to be clicked, no credentials need to be stolen first. That is the pattern to take away from this week: both flaws collapse the distance between "attacker on the internet" and "root on a critical appliance" down to a single crafted request.
Summary
| CVE-2026-76461 | CVE-2026-76460 | |
|---|---|---|
| Product | Cisco Secure Email Gateway (AsyncOS) | Cisco ISE / ISE-PIC |
| CVSS Score | 9.8 | 10.0 |
| Type | SQL injection via email parsing | Authentication bypass on an API endpoint |
| Authentication required? | No | No |
| Disclosed | September 14, 2026 | September 16, 2026 |
| Impact | Command execution with root privileges | Management interface bypass; potential root command execution |
| Active exploitation confirmed? | Yes | Yes |
| Added to CISA KEV | Yes, September 15, 2026 | Yes, September 16, 2026 |
| FCEB remediation deadline | September 17, 2026 | September 19, 2026 |
| Workaround available? | No; upgrade required | No; iACLs as interim risk reduction only |
| Fixed in | AsyncOS 15.5.5-0141 / 16.0.4-302 / 16.5.0-780 | ISE/ISE-PIC 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4 |
Both of these vulnerabilities are confirmed under active exploitation against unauthenticated, internet-facing infrastructure that most organizations treat as trusted by default. If you need help determining whether your Cisco Secure Email Gateway or ISE deployments are affected, checking your logs for indicators of compromise, or managing an emergency patch cycle across a larger Cisco footprint, get in touch. A week with two maximum-severity, actively exploited Cisco zero-days is exactly the kind of situation that benefits from a second set of experienced hands.