erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: September 14, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: Cisco Secure Email Gateway: Two Exploited Root RCE Bugs. Anyone running physical or virtual Cisco Secure Email Gateway on AsyncOS before 15.5.5-014, 16.0.x, or 16.5 before 16.5.0-780, including teams that moved to 16.0.4-302, which fixes only CVE-2026-76461.
  • Do you run any of these? Cisco Secure Email Gateway. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-17.
  • PyPI: 1 critical advisory (esphome-device-builder). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-76461, CVE-2026-76519

Cisco Secure Email Gateway: Two Exploited Root RCE Bugs

Every on-premises Secure Email Gateway below 15.5.5-014 or 16.5.0-780 can be rooted by an email and both bugs are exploited: upgrade now, and check for compromise before and after, because attackers can wipe local evidence.

Must act: Anyone running physical or virtual Cisco Secure Email Gateway on AsyncOS before 15.5.5-014, 16.0.x, or 16.5 before 16.5.0-780, including teams that moved to 16.0.4-302, which fixes only CVE-2026-76461.

Can relax: Secure Email and Web Manager and Secure Web Appliance are not affected by these two CVEs, and Cisco has already upgraded Secure Email Cloud devices (but contacted cloud customers must rotate credentials).

  1. List every gateway and cluster member and its AsyncOS release (version at the CLI).
  2. Before upgrading, run Cisco's IOC checks on every appliance; on virtual appliances, collect forensic data first.
  3. Upgrade to 16.5.0-780, or at minimum 15.5.5-014 (CLI: upgrade, then DOWNLOADINSTALL); 16.0 users must migrate.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-76461Cisco Secure Email Gateway
Cisco Secure Email Gateway SQL Injection Vulnerability		2026-09-17

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)