Root-level RCE in Cisco Secure Email Gateway exploited in the wild as CISA sets three-day deadline

Root code execution delivered by email

On Monday, September 14, a researcher published details of CVE-2026-76461, a remote code execution flaw in Cisco Secure Email Gateway that runs with root privileges. According to a dev.to analysis citing SOCRadar, the attack vector is an ordinary email: while processing an incoming message, the gateway builds a SQL query against its internal database and fails to sanitize the input. Whoever controls the content of the message controls the query, and from there obtains root on the appliance.

Reporting from Help Net Security, cited in the same write-up, adds that the flaw requires no authentication and no user interaction. The only condition is that the malicious email actually reaches the gateway.

CISA's three-day clock

CISA placed the vulnerability in its Known Exploited Vulnerabilities catalog on the same day the details went public, and set a September 17 remediation deadline for US federal agencies. That left three days. KEV inclusion is not routine housekeeping: CISA adds an entry only after exploitation is confirmed in the wild, which means attackers were already at work against real systems while administrators were still reading the advisory.

The dev.to author frames the week from the administrator's side: arrive Monday, check the gateway version, find it on the affected list, and have until Thursday to patch. If the deadline passes, the appliance keeps running with root reachable from the outside.

A second Cisco flaw two days later

On Wednesday, September 16, CVE-2026-76460 surfaced in Cisco Identity Services Engine, the product that decides who enters a network and with what permissions. According to The Hacker News, it is a remote authentication bypass that requires no credentials, carries a CVSS score of 10.0, and was already being exploited. CISA added it to the KEV that same day with a federal deadline of September 19.

The shared profile of the two bugs is hard to miss: unauthenticated flaws in network-exposed edge systems whose job is to process input that cannot be trusted, and both documented with exploitation already underway.

The patch does not evict the intruder

The same Monday, The Hacker News reported that four espionage groups, APT31 among them, deployed the same exploit kit, named BlueMoon, against Chrome and Windows within a single week. The detail that changes the calculus is that remediation does not clear the persistence attackers leave behind: a browser extension called GemStone and its scheduled tasks both survive the fix.

The implication, as the dev.to analysis puts it, is that the long-standing reflex of applying a patch and moving on no longer suffices. A system can end up with the vulnerability sealed while the intruder who used it is still inside.

The write-up connects this to a broader shift. Anthropic published a 154-page threat report on September 10 documenting that its AI agents can rewrite malware to evade detection, and that API keys have become the preferred loot. In that environment, the gap between disclosure and exploitation compresses toward nothing, and small operators can run campaigns that once required a team.

What the write-up recommends checking

The author's practical shortlist for the week:

• Inventory every Secure Email Gateway and ISE deployment, with versions and exposure, and disconnect anything internet-facing that does not need to be there.
• On systems touched by BlueMoon, inspect browser extensions and scheduled tasks after patching, because the fix leaves them in place.
• Rotate API keys used with AI platforms in production and shorten their lifetimes.

Why it matters

Two unauthenticated, actively exploited flaws in internet-facing Cisco infrastructure, each with a federal patch deadline measured in days, mark a change of pace rather than a change of technique. Edge vulnerabilities have always existed; what is new is that exploitation begins before the advisory lands and that persistence outlives the patch. For defenders, the actionable lesson is that a patch is only one third of the response. An organization that cannot say precisely which edge systems it runs, and in which versions, cannot act on any deadline, and one that patches without hunting for leftovers may simply lock the door behind an attacker who is already inside.