Multiple Vulnerabilities in Cisco Secure Email Products Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in Cisco Secure Email products, the most severe of which could allow for remote code execution.

Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution as root, which may lead to the complete compromise of the affected device.

Cisco has confirmed active exploitation of CVE-2026-76461. CISA has also added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 14, 2026.

Multiple vulnerabilities have been discovered in Cisco Secure Email products, the most severe of which could allow for remote code execution. Details of these vulnerabilities are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Lower Severity Vulnerabilities Include:

Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution as root, which may lead to the complete compromise of the affected device.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®