Cisco Patches Exploited Zero-Days in Secure Email Gateway and ISE

Perimeter enterprise appliances are under heavy assault, as confirmed by Cisco’s disclosure of active exploitation surrounding a Cisco Secure Email Gateway zero-day tracked as CVE-2026-76461. The vulnerability allows remote attackers to perform arbitrary SQL injection against vulnerable security appliances. Cisco’s Product Security Incident Response Team (PSIRT) confirmed active, in-the-wild exploitation dating back to September 2025. Adding to the urgency, Cisco confirmed just two days later that threat actors are simultaneously targeting a second critical zero-day: CVE-2026-76460, an authentication bypass flaw in the API management interface of Cisco Identity Services Engine (ISE).

The combined active targeting of secure email infrastructure and network access control systems highlights a focused effort by adversaries to gain persistent access to core edge defenses and identity validation bottlenecks.

Deep Dive into CVE-2026-76461: SQL Injection on the Edge

The vulnerability in Cisco Secure Email Gateway, designated CVE-2026-76461, belongs to the SQL injection class of flaws. Secure email gateways sit on the outermost boundary of an enterprise network, acting as the primary filter for inbound mail traffic, attachment sanitization, and spam mitigation. When an unauthenticated SQL injection vulnerability exists on an edge appliance’s management or processing endpoints, an external attacker can craft malicious input strings that break out of intended database queries.

Because edge gateways frequently execute backend database calls under elevated administrative privileges, a successful SQL injection attack allows remote bad actors to interact directly with the underlying database. Attackers can extract configuration parameters, dump hashed credentials, bypass login logic entirely, or write persistent webshells directly to web-accessible directories on the host operating system. Achieving unauthenticated foothold status on an email gateway gives adversaries complete visibility into inbound and outbound corporate communications without needing internal network access or domain credentials.

Cisco ISE Authentication Bypass (CVE-2026-76460)

Shortly after issuing advisories for the email gateway zero-day, Cisco confirmed targeted attacks against CVE-2026-76460 in Cisco Identity Services Engine (ISE). Cisco ISE serves as a centralized administrative nerve center across corporate environments. It validates connecting users, profiles untrusted endpoints, checks device security posture against corporate compliance rules, grants conditional network access, and logs overall activity.

The flaw itself is an authentication bypass residing within an API exposed by Cisco ISE’s management interface. Under normal operation, API endpoints require validated administrative tokens or certificates before granting access to internal management routines. When an authentication bypass vulnerability exists in an API framework, unauthenticated attackers can construct HTTP requests that bypass these security checks.

By successfully exploiting CVE-2026-76460, an remote unauthenticated actor can issue administrative commands to Cisco ISE. In an operational context, gaining unauthorized control of an ISE deployment allows attackers to modify network authorization policies, force devices into high-trust VLANs, alter posture validation rules, and blind logging mechanisms that incident responders rely on during breach triage.

Blast Radius and Enterprise Impact

The operational fallout from compromising either of these platforms is severe, but the combination of both targeted flaws exposes organizations to compound risks:

• Perimeter Compromise & Reconnaissance: A compromised Cisco Secure Email Gateway grants threat actors front-row access to internal personnel structures, sensitive corporate documentation, and proprietary email threads. Adversaries often use email gateway footholds to launch convincing internal spear-phishing campaigns or intercept multi-factor authentication reset emails.
• Network Access & Lateral Movement: Exploiting Cisco ISE disables the central gatekeeper enforcing enterprise network microsegmentation. An attacker who controls ISE can bypass zero-trust network architecture (ZTNA) constraints, moving freely between previously isolated corporate subnets, operational technology (OT) zones, and administrative management segments.
• Credential Harvesting: Both email gateways and identity engines store extensive integration credentials, including Active Directory bind accounts, LDAP service keys, and database passwords. Extracting these credentials provides immediate pathways to broader domain compromise.

Remediation and Mitigation Guidance

Cisco has released official software updates addressing both CVE-2026-76461 and CVE-2026-76460, along with indicators of compromise (IoCs) to help security operations teams determine whether their environments were targeted prior to patch application.

1. Apply Security Updates Immediately: Update all instances of Cisco Secure Email Gateway and Cisco Identity Services Engine to the latest patched software versions released by Cisco PSIRT.
2. Hunt for Indicators of Compromise: Review web server logs, API request logs, and database process calls for anomalous SQL injection syntax or unexpected HTTP requests targeting ISE API endpoints.
3. Isolate Management Interfaces: Ensure management web consoles and APIs for Cisco ISE and Cisco Secure Email Gateway are not directly accessible from the public internet. Restrict management access exclusively to isolated out-of-band management VLANs protected by multi-factor authentication.
4. Rotate Exposed Credentials: If unauthorized access or anomaly indicators are detected on affected appliances, immediately rotate all service account credentials, database passwords, and integrated directory accounts configured within the devices.