The main case
On Monday, September 14, a researcher publishes the details of CVE-2026-76461 (Source: SOCRadar), a remote code execution with root privileges in Cisco Secure Email Gateway. The vector is an email with malicious SQL inside it. No authentication required, no user interaction required, nothing required except the message reaching the gateway (helpnetsecurity.com).
That same day, CISA adds the vulnerability to its Known Exploited Vulnerabilities catalog, the KEV, and sets a patch deadline for U.S. federal agencies that expires on September 17. Three days. Not three weeks, not a quarter. Three days for an email gateway exposed to the internet.
The concrete scene is this. An administrator arrives on Monday, opens email, sees the advisory, checks the version of their Secure Email Gateway and finds it on the list. They have until Thursday. If they do not patch, the system sits with root accessible from outside.
The technical detail that matters is the SQL injection. The gateway processes the message, builds a query against its internal database and does not sanitize the input properly. An attacker who controls the content of the email controls that query. And from there, root.
What stands out is not the flaw itself. It is the calendar. CISA does not add something to the KEV for fun. It adds it when there is confirmed exploitation in the wild. That means someone is already using it against real systems while administrators read the advisory.
Not an isolated case
On Wednesday, September 16, the same week, CVE-2026-76460 shows up in Cisco ISE. Remote authentication bypass, no credentials, CVSS 10.0, exploited in the wild. CISA puts it in the KEV that same day and sets a federal deadline for September 19 (thehackernews.com).
ISE is Identity Services Engine. It is the system that decides who gets into the network and with what permissions. An authentication bypass there is not just any flaw. It is the first phase of an intrusion, the point from which an attacker moves laterally inward.
Two Cisco products, two flaws without authentication, two KEV entries, two deadlines measured in days. The common shape is clear. They are edge systems, network-exposed, that process untrusted input and serve as a door. And both arrived with exploitation already documented.
The pattern repeats outside Cisco. The same Monday, four espionage groups, APT31 among them, used the same exploit kit, BlueMoon, against Chrome and Windows in a single week. And there is a detail worth underlining. Patching is not enough. The GemStone extension and the scheduled tasks survive the fix (thehackernews.com).
That is what changes the ground. For years, the answer to a zero-day was patch and breathe. Now you have to patch and also clean up the persistence the attacker left before the patch arrived. If you only do the first, the system ends up with the door closed and the intruder inside.
The other side
The week also brings the reverse. Anthropic's threat report, 154 pages published on September 10, documents that its agents rewrite malware to evade detection and that the loot is now API keys (anthropic.com).
The report's conclusion is uncomfortable. AI erases the skill gap. Small actors run state-level campaigns. A single operator with an API replicates what used to require a team.
This connects to the main case in another way. The Cisco zero-day is exploited with an email. The BlueMoon exploit kit is deployed in a week. The technical barrier to entry drops, and the window between disclosure and exploitation compresses until it disappears.
My reading is that we are looking at a change of pace, not of technique. Edge flaws without authentication have always existed. What is new is that exploitation arrives before the advisory, and that the attacker leaves persistence the patch does not touch. The defender who only watches the CVE is left halfway.
It is worth saying plainly, even if it stings. If your inventory of edge systems is not up to date, you do not know what you have exposed. And if you do not know what you have exposed, CISA's deadline is useless to you.
What to look at on Monday
- Edge inventory. List every Cisco Secure Email Gateway and ISE on your network, with version and exposure. If any of them is on the internet without need, close it before patching.
- Persistence after the patch. On systems affected by BlueMoon, check browser extensions and scheduled tasks. The fix does not remove them.
- Key rotation. If you have API keys from AI platforms in production, rotate them and shorten their lifetime. The Anthropic report flags them as priority loot.
How I would test it in my lab
I would spin up a container with a vulnerable version of a mail service and send it a message with a simple SQL payload, to see whether the query executes. I would not look for the real exploit, just confirm that the input is not sanitized. Then I would apply the patch and repeat the send, to check that the same payload no longer goes through. The conclusion would be simple. If the behavior changes between before and after, the patch does what it says. If it does not change, I have a bigger problem than the CVE.
Closing
The window between flaw and exploitation is no longer measured in weeks, and the patch only closes the door, it does not throw out whoever already came in. Monday is for inventory and cleanup, not just updating.
Originally published at https://sammideblas.com/notas/cisco-s-two-exploited-flaws-and-cisa-s-patch-clock
