Threat hunting

Cisco has already contacted Secure Email Cloud customers where it found compromise indicators

CVE-2026-76461 was in use before Monday's advisory and Cisco says multiple customers were likely compromised first, so a gateway patched this week still needs a hunt against indicators that root access can erase.