Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in the Secure Email Gateway that permits attackers to run commands with root privileges on affected appliances.
The issue, identified as CVE-2026-76461 and rated CVSS 9.8, resides in the AsyncOS software used by both physical and virtual versions of the product. Insufficient validation of message analysis logic allows an attacker to send a specially crafted email containing malicious SQL instructions. Successful exploitation results in arbitrary SQL command execution that ultimately grants root-level access.
The attack surface is particularly concerning because email gateways are designed to accept messages from any sender, meaning the vector is exposed by default to anyone who can craft the correct payload. Impacted versions include 15.5 and earlier, 16.0, and 16.5. Fixed releases are 15.5.5-0141, 16.0.4-302, and 16.5.0-780.
The Secure Email and Web Manager and Secure Web Appliance are not affected. No workaround exists, so administrators must apply the available patches. CISA added the identifier to its Known Exploited Vulnerabilities catalog on September 14 and set September 17 as the deadline for federal agencies to remediate.
Cisco verified the attacks occurred in September but did not disclose the scale of compromise. Organizations are advised to review email and cluster logs for suspicious SQL activity and to examine network and firewall logs for anomalous data transfers.
Related articles
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.
R-Vision VM 6.6 Adds Container Scanning, Web Application Audits and Mobile Scanner for Isolated Networks
R-Vision has released version 6.6 of its vulnerability management platform, expanding detection capabilities to web applications, Docker and Kubernetes container environments, and previously unreachable isolated network segments. The new web audit feature inventories resources and identifies associated vulnerabilities, although the company describes the current functionality as basic and not intended to replace dedicated DAST solutions. Container auditing now covers both Docker and Kubernetes, including runtime analysis, with findings presented directly in the host card within the central console. The most notable addition is a mobile scanner that runs on a laptop without requiring dedicated servers, allowing security specialists to audit air-gapped or remote sites and later upload results to the main R-Vision VM instance. The mobile component supports White Box, Black Box, Compliance and web-audit modes, performs full inventory, and is designed to scan up to 2000 hosts. Additional improvements include expanded inventory for ESXi, vCenter and network equipment, updated compliance checks, enhanced dashboards, automation policies and data export options, plus the ability to update agents directly from the interface.