Cisco ISE and Secure Email Gateway: CVE-2026-76460 and 76461 in CISA KEV

Two days apart, CISA added two unauthenticated Cisco vulnerabilities to its KEV catalog, on two products with one thing in common: they are security devices, placed exactly where the organisation extends trust.

NVD has published no score, vector or versions for either at the time of writing. I'm relying on the CISA descriptions; fixed releases are in the Cisco PSIRT advisories.

CVE-2026-76461 — Secure Email Gateway: root from a request

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

An email gateway sees every message entering and leaving the organisation. With root on it, an attacker can:

• read all mail, including attachments and received password resets
• alter messages in transit — insert a link, swap bank details on an invoice
• disable filtering to let their own phishing campaign in, carrying the victim domain's reputation
• persist on a device with no EDR that nobody inspects

The gateway is also, by construction, internet-exposed: it has to accept SMTP from the whole world.

CVE-2026-76460 — ISE: privileged APIs left open

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

ISE is the network access controller (NAC): it decides who may join the network, on which VLAN, with which rights. "Bypassing the web-based management interface" describes an alternate path to privileged APIs the interface protects — the same flaw class as Citrix and Cisco FMC this month.

Controlling ISE means being able to authorise yourself onto the network, carve policy exceptions, and read the identities of every connected device and user.

Detection

Secure Email Gateway

• Unknown administrator or CLI accounts
• Undocumented changes to filtering policies, sender allowlists or routing rules
• Abnormal outbound mail in volume or destination
• Database errors in application logs — injection attempts leave traces before successful ones
• Deep investigation needs Cisco TAC: the appliance is a closed system

ISE

• Administrative actions with no corresponding login session in audit logs
• Recently modified authorisation policies or profiles
• Newly authorised endpoints outside normal processes
• API calls from addresses that aren't admin workstations

Mitigation

1. Apply the Cisco fixes — both CISA deadlines have passed.
2. Restrict both products' management interfaces to a management network. On the SEG only SMTP should be exposed; on ISE, admin portals and APIs must not be reachable from user networks.
3. After patching: rotate administrator credentials, shared RADIUS and TACACS+ secrets, certificates.
4. If the SEG was compromised: treat email content from the period as exposed, especially password-reset links, and warn teams that may have received altered messages (accounts payable, purchasing).

Why Continuous Monitoring of Security Devices Matters

An email gateway and a NAC are configured once and then forgotten, because they "just work". Yet they're among the most exposed and most privileged devices in the estate, and two unauthenticated CVEs entered KEV on them within two days.

With cveo.tech, inventory your Cisco security devices with exact versions and get alerted whenever a critical CVE — particularly a KEV-listed one — affects them.