{"metadata": {"vulnerability": "CVE-2026-76461", "count": 171, "kinds": {"milestone": 8, "sighting": 132, "kev": 11, "other": 20}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0368", "record": "NCSC-2026-0368", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-19T12:02:03.637Z", "date_only": false, "value": "2026-08-19T12:02:03.637Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-76461", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": true, "value": "2026-09-14", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76461", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": true, "value": "2026-09-14", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "evidence.0.details.date_added", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": true, "value": "2026-09-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1175", "record": "CERTFR-2026-AVI-1175", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76461", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76461", "record": "FKIE_CVE-2026-76461", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "status.status_updated_at", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76461", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-76461", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "a16cbb03-0793-4e02-8eba-a5b7659656d1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-76461", "field": "evidence.0.details.added_date", "uuid": "a16cbb03-0793-4e02-8eba-a5b7659656d1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-76461", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "a16cbb03-0793-4e02-8eba-a5b7659656d1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-76461", "field": "status.status_updated_at", "uuid": "a16cbb03-0793-4e02-8eba-a5b7659656d1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T16:00:38Z", "date_only": false, "value": "2026-09-14T16:00:38+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-14T16:09:07.839Z", "date_only": false, "value": "2026-09-14T16:09:07.839Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-76461", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-14T16:34:23.311Z", "date_only": false, "value": "2026-09-14T16:34:23.311586Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117270349040395789", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "0c15c4af-0ff2-4745-8365-edbeb18bdfb8", "content": "ayy lmao Cisco CVE-2026-76461A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\n\nIn September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX\n#cve #cisco #zeroday #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117270349040395789"}, {"timestamp": "2026-09-14T16:42:48.618Z", "date_only": false, "value": "2026-09-14T16:42:48.618768Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117270391382884208", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "031ed0bf-525d-4126-bae7-792d33adabe5", "content": "Welcome to Monday and two new advisories from Cisco.\nCRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm\nCRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX\nTwo more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability \n@cR0w", "url": "https://infosec.exchange/users/AAKL/statuses/117270391382884208"}, {"timestamp": "2026-09-14T17:17:51Z", "date_only": false, "value": "2026-09-14T17:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JWPF-JWW6-H6VR", "record": "GHSA-JWPF-JWW6-H6VR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-14T17:17:51.113Z", "date_only": false, "value": "2026-09-14T17:17:51.113", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76461", "record": "FKIE_CVE-2026-76461", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-14T17:30:06.408Z", "date_only": false, "value": "2026-09-14T17:30:06.408188Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvin6is2qf2r", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "ddfc0962-9e27-4053-8cfd-5f5940cfb97a", "content": "CVE-2026-76461 - cisco secure email\nCisco Secure Email Gateway can be tricked by a specially crafted email to run any command on the system with full administrative rights. The flaw exists because the email parser does\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cisco #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mvin6is2qf2r"}, {"timestamp": "2026-09-14T18:09:12.736Z", "date_only": false, "value": "2026-09-14T18:09:12.736313Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvipegpen52w", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "fe30ffc6-0323-4bff-93b8-a3972e872554", "content": "\ud83d\udea8 CVE-2026-76461 \u2014 CVSS 9.8 CRITICAL\n\nA vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76461\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvipegpen52w"}, {"timestamp": "2026-09-14T18:27:05.647Z", "date_only": false, "value": "2026-09-14T18:27:05.647283Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0368", "record": "NCSC-2026-0368", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-14T18:27:05.647Z", "date_only": false, "value": "2026-09-14T18:27:05.647283Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0368", "record": "NCSC-2026-0368", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-14T18:27:05.647Z", "date_only": false, "value": "2026-09-14T18:27:05.647283Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0368", "record": "NCSC-2026-0368", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-14T18:31:22Z", "date_only": false, "value": "2026-09-14T18:31:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JWPF-JWW6-H6VR", "record": "GHSA-JWPF-JWW6-H6VR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-14T19:00:34.572Z", "date_only": false, "value": "2026-09-14T19:00:34.572613Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/cisco-sfuttamento-in-rete-della-cve-2026-76461-relativa-a-secure-email-gateway", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "9c57ab86-3f9c-4d8b-98be-4c3684bda007", "content": "Cisco ha rilasciato aggiornamenti di sicurezza per sanare 6 vulnerabilit\u00e0, di cui 5 con gravit\u00e0 \"critica\" e una con gravit\u00e0 \"alta\", che interessano Cisco Secure Email Gateway, soluzione per la protezione e la gestione della posta elettronica, e Cisco Secure Email and Web Manager, piattaforma per la gestione centralizzata dei relativi servizi di sicurezza.", "url": "https://www.acn.gov.it/portale/w/cisco-sfuttamento-in-rete-della-cve-2026-76461-relativa-a-secure-email-gateway"}, {"timestamp": "2026-09-14T19:13:28.052Z", "date_only": false, "value": "2026-09-14T19:13:28.052207Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mvisxcx4xy25", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "8344c342-7dc8-4eef-8add-9bcf0581c203", "content": "\ud83d\uded1 CVE-2026-76461\nCisco Secure Email Gateway\nCVSS 9.8 / KEV \u2705\nTL;DR: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gatewa\u2026\nhttps://cvesentinel.com/report/CVE-2026-76461?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mvisxcx4xy25"}, {"timestamp": "2026-09-14T19:32:25.578Z", "date_only": false, "value": "2026-09-14T19:32:25.578608Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mvitz7j2d52u", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "65a578ac-c17d-4514-927b-e53403c86a8f", "content": "Cisco confirms active exploitation of CVE-2026-76461 in Secure Email Gateway, CVSS 9.8: a crafted email gets an unauthenticated attacker root on the appliance. No workaround, fixed builds are out, and CISA added it to KEV today. sec.cloudapps.cisco.com/...", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mvitz7j2d52u"}, {"timestamp": "2026-09-14T20:00:01Z", "date_only": false, "value": "2026-09-14T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-14T20:00:02.074Z", "date_only": false, "value": "2026-09-14T20:00:02.074470Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ac436c8-102a-4823-ba5c-e8df968c9d63", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "c46d1e87-09e7-4a50-ad52-3ab116bd1fa9", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ac436c8-102a-4823-ba5c-e8df968c9d63", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T20:15:06.417Z", "date_only": false, "value": "2026-09-14T20:15:06.417851Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-921", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "fd7e5dab-d76a-4b0e-8042-c040a1d2ff15", "url": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-921"}, {"timestamp": "2026-09-14T20:56:10.595Z", "date_only": false, "value": "2026-09-14T20:56:10.595703Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mviyoxftkh2h", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "6099dde0-d828-4f9f-982a-f195762e9665", "content": "CRITICAL CISA KEV ALERT: CVE-2026-76461 targets Cisco Secure Email Gateway via SQL injection, granting root-level RCE. Active exploitation verified. Access our TSUITE brief for SIEM queries and hardening steps to secure your email perimeter.\n\nhttps://thecybermind.co/al1f", "url": "https://bsky.app/profile/thecybermind.co/post/3mviyoxftkh2h"}, {"timestamp": "2026-09-14T21:00:34.869Z", "date_only": false, "value": "2026-09-14T21:00:34.869204Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mviywu7w6e25", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "099436f6-f8cd-4e80-8d6f-653bbf8ca80c", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0914)\n\n\u26a0\ufe0f CVE-2026-76461 - Cisco Secure Email Gateway SQL Injection Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mviywu7w6e25"}, {"timestamp": "2026-09-14T21:11:23.782Z", "date_only": false, "value": "2026-09-14T21:11:23.782820Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvizk6tusl2w", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d38ed0e3-27f3-422e-8e5f-e4c20f2c9dda", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote\u2026\nCVSS 9.8 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-76461\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mvizk6tusl2w"}, {"timestamp": "2026-09-14T21:31:41Z", "date_only": false, "value": "2026-09-14T21:31:41Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JWPF-JWW6-H6VR", "record": "GHSA-JWPF-JWW6-H6VR", "field": "modified"}, {"timestamp": "2026-09-14T23:12:25.202Z", "date_only": false, "value": "2026-09-14T23:12:25.202449Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mvjacmbogd2c", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "0a55eb39-1b4e-459b-8a92-9999cecde776", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-76461", "url": "https://bsky.app/profile/csirts.com/post/3mvjacmbogd2c"}, {"timestamp": "2026-09-15T00:00:00Z", "date_only": false, "value": "2026-09-15T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1175", "record": "CERTFR-2026-AVI-1175", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T00:00:00Z", "date_only": false, "value": "2026-09-15T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1175", "record": "CERTFR-2026-AVI-1175", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-15T00:00:18.488Z", "date_only": false, "value": "2026-09-15T00:00:18.488306Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mvjcy7bczj27", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "7a83573d-5f1b-4c41-b36b-8ba3ed244705", "content": "Win11 OOBs KB5129195/9242/9194 fix RDP, WSL shares and USB audio across 23H2\u201326H1. CISA flags exploited Cisco SEG RCE CVE-2026-76461. Teams caption pop-out freezes on 24H2 build 26100.9168. +20 more stories; 36 joined", "url": "https://bsky.app/profile/windowsforum.com/post/3mvjcy7bczj27"}, {"timestamp": "2026-09-15T02:17:58.123Z", "date_only": false, "value": "2026-09-15T02:17:58.123428Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvjkoequkh2l", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "465051fe-084f-4637-afe9-0f248b261aba", "content": "CVE-2026-76461 (CVSS 9.8) is a Cisco Secure Email Gateway vulnerability exploited in the wild. SQL injection grants root command execution. Patch now.\n\n#Cisco #EmailSecurity #CVE202676461 #SQLInjection #RCE #ExploitedInTheWild #AsyncOS #InfoSec #PatchNow #RootAccess", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mvjkoequkh2l"}, {"timestamp": "2026-09-15T03:00:26.806Z", "date_only": false, "value": "2026-09-15T03:00:26.806287Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117272820193403304", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "5a201267-4a7b-4980-93c9-a10742d344a7", "content": "CRITICAL (CVSS 9.8): CVE-2026-76461 in Cisco AsyncOS for Secure Email Gateway lets unauthenticated attackers execute commands as root via crafted emails. Patch status unknown \u2014 monitor Cisco\u2019s updates. https://radar.offseq.com/threat/a-vulnerability-in-the-email-parsing-of-cisco-asyncos-software-for-cisco-secure-email-gateway-could-a5a1b3247d786df4 #OffSeq #Cisco #Vulnerability #EmailSecurity", "url": "https://infosec.exchange/users/offseq/statuses/117272820193403304"}, {"timestamp": "2026-09-15T03:00:30.169Z", "date_only": false, "value": "2026-09-15T03:00:30.169602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvjn2fu7lx2b", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "1c5cf05f-dff0-4091-896b-00a2fcede48e", "content": "CRITICAL: Cisco AsyncOS for Secure Email Gateway flaw (CVE-2026-76461, CVSS 9.8) allows unauthenticated RCE via crafted emails. Patch status unknown \u2014 track vendor guidance. https://radar.offseq.com/threat/a-vulnerability-in-the-email-parsing-of-cisco-asyncos-software-for-cisco-secure-email-gatew...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mvjn2fu7lx2b"}, {"timestamp": "2026-09-15T03:10:30.627Z", "date_only": false, "value": "2026-09-15T03:10:30.627287Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvjnmdto2t2j", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "1b86e69a-77f5-4eb2-a33c-c16561ff34ad", "content": "Patch Cisco Secure Email Gateway now \u2014 CVE-2026-76461 (CVSS 9.8) SQLi gives root RCE, on CISA KEV. Fix: 15.5.5-0141/16.0.4-3021/16.5.0-780. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvjnmdto2t2j"}, {"timestamp": "2026-09-15T03:56:06.270Z", "date_only": false, "value": "2026-09-15T03:56:06.270Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76461", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T04:01:20.088Z", "date_only": false, "value": "2026-09-15T04:01:20.088239Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvjqh5h7gh2y", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "37cb59a8-563f-4552-9d03-d3e5f7287439", "content": "~Cisa~\nCISA added an actively exploited Cisco Secure Email Gateway SQL injection flaw to its KEV Catalog.\n-\nIOCs: CVE-2026-76461\n-\n#CVE-2026-76461 #Cisco #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mvjqh5h7gh2y"}, {"timestamp": "2026-09-15T05:02:51.215Z", "date_only": false, "value": "2026-09-15T05:02:51.215975Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvjtva3mpb2h", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "6477722e-6a30-4f43-b70d-801617d51f12", "content": "Daily IT Security Digest \u2014 2026-09-15\nhttps://hackread.com/f5-breach-so...\n\n## 4. Cisco AsyncOS RCE in Secure Email Gateway (CRITICAL \u2014 CVSS 9.8)\n\nCisco has disclosed CVE-2026-76461, a critical vulnerability in AsyncOS for Secure Email Gateway that allows unauthenticated attackers to execute", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3mvjtva3mpb2h"}, {"timestamp": "2026-09-15T05:15:02.191Z", "date_only": false, "value": "2026-09-15T05:15:02.191096Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/cisco-products-multiple-vulnerabilities_20260915", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "b5288c31-61ad-49ed-a06f-a45de1ee5e88", "url": "https://www.hkcert.org/security-bulletin/cisco-products-multiple-vulnerabilities_20260915"}, {"timestamp": "2026-09-15T05:15:46.765Z", "date_only": false, "value": "2026-09-15T05:15:46.765157Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvjumdpl4o2u", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "a1c1c318-a76d-46cf-b87b-edc62e125f4c", "content": "\u30cf\u30c3\u30ab\u30fc\u304cCisco Secure Email Gateway\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001root\u6a29\u9650\u3067\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\n\nCisco\u306f\u3001Secure Email Gateway\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u306aSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u8a8d\u8a3c\u306a\u3057\u3067\u60aa\u7528\u53ef\u80fd\u3067\u3042\u308a\u3001\u653b\u6483\u8005\u306f\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30c7\u30d0\u30a4\u30b9\u4e0a\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u3092root\u6a29\u9650\u3067\u5b9f\u884c\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002 CVE-2026-76461", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvjumdpl4o2u"}, {"timestamp": "2026-09-15T05:31:18.170Z", "date_only": false, "value": "2026-09-15T05:31:18.170301Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvjvi3wfzb2n", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "37f503c4-e058-4a2a-8997-e3ec20ce59ff", "content": "CVE-2026-76461 in Cisco Secure Email Gateway AsyncOS is a remotely exploitable, unauthenticated root-command zero-day actively used in attacks.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvjvi3wfzb2n"}, {"timestamp": "2026-09-15T06:30:43.278Z", "date_only": false, "value": "2026-09-15T06:30:43.278935Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mvjyse2p6t2b", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "dd2aad0a-4127-4b9d-972f-93c02b868a03", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-76461: \u26a0\ufe0f CVE-2026-76461: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-76461-a-vulnerability-in-the-email-parsing", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mvjyse2p6t2b"}, {"timestamp": "2026-09-15T06:30:59.867Z", "date_only": false, "value": "2026-09-15T06:30:59.867577Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mvjystpiyk2j", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "18862816-f6a2-413d-95ba-8bc4387c9cf2", "content": "\u3010\u7dca\u6025\u3011Cisco Secure Email Gateway\uff08CVE-2026-76461 / CVSS 9.8 CRITICAL\uff09\n\n\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u304c1\u901a\u5c4a\u304f\u3060\u3051\u3067\u3001\u672a\u8a8d\u8a3c\u306e\u653b\u6483\u8005\u304croot\u6a29\u9650\u3067\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002\u53d7\u4fe1\u8005\u304c\u958b\u304f\u5fc5\u8981\u3082\u3042\u308a\u307e\u305b\u3093\u3002Cisco\u81ea\u8eab\u304c2026\u5e749\u6708\u306b\u5b9f\u969b\u306e\u60aa\u7528\u3092\u78ba\u8a8d\u3057\u3066\u304a\u308a\u3001\u56de\u907f\u7b56\u306f\u3042\u308a\u307e\u305b\u3093\u3002\n\n\u5bfe\u51e6: AsyncOS\u309215.5.5-014\uff0f16.0.4-302\uff0f16.5.0-780\u3078\u3002\n\nforsmile.jp/articles/cis...", "url": "https://bsky.app/profile/forsmile.jp/post/3mvjystpiyk2j"}, {"timestamp": "2026-09-15T06:31:46.281Z", "date_only": false, "value": "2026-09-15T06:31:46.281179Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvjyu7hucv2e", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "02662e22-d13a-4322-8c81-ced99a14f68a", "content": "CVE-2026-76461 in Cisco Secure Email Gateway AsyncOS is actively exploited, enabling unauthenticated remote root command execution via crafted emails.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mvjyu7hucv2e"}, {"timestamp": "2026-09-15T06:33:01.847Z", "date_only": false, "value": "2026-09-15T06:33:01.847292Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvjywh5utx2t", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "56a7a1d4-10d6-4c0c-ab5a-ab7098d5b0a0", "content": "CVE-2026-76461 in Cisco Secure Email Gateway AsyncOS is actively exploited, enabling unauthenticated remote root command execution via crafted emails.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvjywh5utx2t"}, {"timestamp": "2026-09-15T06:38:07.004Z", "date_only": false, "value": "2026-09-15T06:38:07.004423Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvjz7klh3o2n", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "3423df57-c0a4-4c1c-96ab-2391269870d4", "content": "Top 3 CVE for last 7 days:\nCVE-2026-20079: 22 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-85706: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-51990: 5 interactions\nCVE-2026-76461: 5 interactions\nCVE-2026-85706: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mvjz7klh3o2n"}, {"timestamp": "2026-09-15T06:49:50.588Z", "date_only": false, "value": "2026-09-15T06:49:50.588090Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mvjzujmpzz23", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "03288b06-d153-420a-825d-9f9c0757bd27", "content": "Everyone's talking about how fragile everything is this week. Look at the root RCE in Cisco Secure Email Gateway (CVE-2026-76461), those authentication bypasses in JFrog Artifactory, or the urgent warnings CISA put out\u2026\n\n#vulnerability #databreach #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mvjzujmpzz23"}, {"timestamp": "2026-09-15T07:00:35.828Z", "date_only": false, "value": "2026-09-15T07:00:35.828703Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "1fe0eacd-0a37-4dc9-b793-6884a7abd0b2", "content": "An unauthenticated attacker can exploit CVE-2026-76461 to execute arbitrary commands on the underlying OS with root privileges.\n\nThe post Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation appeared first on SecurityWeek.", "url": "https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/"}, {"timestamp": "2026-09-15T07:01:24.992Z", "date_only": false, "value": "2026-09-15T07:01:24.992468Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mvk2j7zujg2g", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "0bfe4f56-4a42-45d2-a2ff-416f4eaf1314", "content": "\u6ce8\u610f\u559a\u8d77: Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\n\nCisco\u306f2026\u5e749\u670815\u65e5\u3001Cisco Secure Email Gateway\u306eSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027CVE-2026-76461\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u3067\u3001\u8106\u5f31\u6027\u306e\u3042\u308b\u30b7\u30b9\u30c6\u30e0\u3067root\u6a29\u9650\u3067\u306e\u4efb\u610f\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002JPCERT/CC\u306f2026\u5e749\u6708\u306e\u60aa\u7528\u78ba\u8a8d\u3068\u56fd\u5185\u3067\u306e\u904e\u53bb\u4fb5\u5bb3\u4e8b\u6848\u3092\u5831\u544a\u3057\u3066\u304a\u308a\u3001\u5bfe\u8c61\u88fd\u54c1\u30e6\u30fc\u30b6\u30fc\u306f\u7dca\u6025\u306b\u30a2\u30c3\u30d7\u30b0\u30ec\u30fc\u30c9\u3068\u4fb5\u5bb3\u8abf\u67fb\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "url": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mvk2j7zujg2g"}, {"timestamp": "2026-09-15T07:03:22.562Z", "date_only": false, "value": "2026-09-15T07:03:22.562612Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mvk2mei775w2", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "e9ce9265-1b7f-454b-8ad6-64af3033eb4e", "content": "\u3010JPCERT\u3011\u6ce8\u610f\u559a\u8d77: Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260027.html\n\nNVNB\u306f\u8106\u5f31\u6027\u60c5\u5831\u306e\u95b2\u89a7\u3092\u652f\u63f4\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\nhttps://nvnb.blossomsarchive.com/", "url": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mvk2mei775w2"}, {"timestamp": "2026-09-15T08:00:05.956Z", "date_only": false, "value": "2026-09-15T08:00:05.956463Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvk5s65j472q", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "e0d8d717-7344-49af-bc00-040e14550cd9", "content": "\ud83e\udd16 CVE-2026-76461 (CVSS 9.8): critical Cisco Secure Email Gateway flaw actively exploited. Unauthenticated remote RCE as root via email parsing flaw. Patch now.\nhttps://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mvk5s65j472q"}, {"timestamp": "2026-09-15T08:22:28.026Z", "date_only": false, "value": "2026-09-15T08:22:28.026786Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mvk724rzvkym", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "e54fb54c-db1d-4dca-8b35-2917694b6f69", "content": "Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260027.html", "url": "https://bsky.app/profile/shiojiri.com/post/3mvk724rzvkym"}, {"timestamp": "2026-09-15T08:45:03.821Z", "date_only": false, "value": "2026-09-15T08:45:03.821381Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-26", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "1498546e-d52d-422a-97a0-61d778e2544e", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-26"}, {"timestamp": "2026-09-15T09:00:04.318Z", "date_only": false, "value": "2026-09-15T09:00:04.318105Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10055", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "8f8ef560-dc10-4abc-a555-ee55def88689", "content": "\u203c\ufe0f Attackers are exploiting a Cisco Secure Email Gateway vulnerability that can let a crafted email trigger command execution as root.\n\nCisco has released fixes, and CISA added CVE-2026-76461 to its KEV catalog.\n\nHow the attack works \u2192 https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html", "url": "https://t.me/thehackernews/10055", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T09:00:04.378Z", "date_only": false, "value": "2026-09-15T09:00:04.378266Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/55918", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "96fb767e-e76d-48d5-ba78-8d48674061ec", "content": "Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation\nhttps://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/\n\nAn unauthenticated attacker can exploit CVE-2026-76461 to execute arbitrary commands on the underlying OS with root privileges.\nThe post Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation (https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55918", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T09:00:07.398Z", "date_only": false, "value": "2026-09-15T09:00:07.398743Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvkb5ij6za2x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "94dec8af-4e38-4e08-8d2e-c6353e2f4f22", "content": "\ud83d\udce2 [VULN] \u26a0\ufe0fInjection SQL exploit\u00e9e dans Cisco Secure Email Gateway - CVE-2026-76461\n\nLe 14 septembre 2026 \u00e0 16 h 00 UTC, Cisco a publi\u00e9 deux avis de s\u00e9curit\u00e9 sur sa passerelle de messagerie.\n\n#CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvkb5ij6za2x"}, {"timestamp": "2026-09-15T09:40:18.614Z", "date_only": false, "value": "2026-09-15T09:40:18.614078Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mvkdfec6d72i", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "870e7773-1991-4f33-a321-22237521629d", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260027.html\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mvkdfec6d72i"}, {"timestamp": "2026-09-15T09:45:27.206Z", "date_only": false, "value": "2026-09-15T09:45:27.206033Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkdojubkw2c", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d5c7948f-55b5-4cfb-8ae5-e98bf7ddde75", "content": "Cisco Secure Email Gateway flaw CVE-2026-76461 is being actively exploited, letting unauthenticated attackers run root commands via crafted email. CISA added it to KEV. #Cisco #CISA #Fortinet", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkdojubkw2c"}, {"timestamp": "2026-09-15T10:00:29.138Z", "date_only": false, "value": "2026-09-15T10:00:29.138390Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkejgnvam24", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "c66f0348-2f92-46cb-8c22-35920b697273", "content": "Cisco warns of active exploitation of CVE-2026-76461, a critical zero-day in Secure Email Gateway appliances. A crafted email can grant root command execution. CISA added it to the KEV catalog. #Cisco #CVE202676461 #KEV", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkejgnvam24"}, {"timestamp": "2026-09-15T10:00:45.678Z", "date_only": false, "value": "2026-09-15T10:00:45.678029Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "5311e6f3-83a9-4724-9b98-30f0d71d7883", "content": "Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of insufficient validation in the email parsing logic that could allow an unauthenticated, remote attacker", "url": "https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html"}, {"timestamp": "2026-09-15T10:45:22.965Z", "date_only": false, "value": "2026-09-15T10:45:22.965134Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkgzpbd5s27", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "c5a8803f-ab7a-4d88-b5c6-ceb4c3015edd", "content": "Cisco patched CVE-2026-76461, a critical zero-day in Secure Email Gateway actively exploited to run root commands without auth. CISA added it to KEV, and Cisco disclosed more critical flaws. #Cisco #CISA #KEV", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkgzpbd5s27"}, {"timestamp": "2026-09-15T11:14:19.818Z", "date_only": false, "value": "2026-09-15T11:14:19.818075Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mvkinfjmkk2z", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "6ac241b5-a602-4d40-9cf0-d007fb85fa0f", "content": "Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)\n\n\ud83d\udd17 Read more: www.helpnetsecurity.com/2026/09/15/c...\n\n#cybersecurity #cybersecuritynews #0day #emailsecurity #enterprise #SMBs @cisco.com", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mvkinfjmkk2z"}, {"timestamp": "2026-09-15T11:31:20.835Z", "date_only": false, "value": "2026-09-15T11:31:20.835893Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvkjlv7fnt2n", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "ce8efb66-1abd-46fa-9d19-39f0e770a0b4", "content": "Cisco\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u30e1\u30fc\u30eb\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027(CVE-2026-76461)\u3092\u4fee\u6b63\n\nCisco\u306f\u6708\u66dc\u65e5\u3001Secure Email Gateway\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u304c\u30bc\u30ed\u30c7\u30a4\u306e\u30b7\u30fc\u30b1\u30f3\u30b7\u30e3\u30eb\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3(SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3)\u8106\u5f31\u6027(CVE-2026-76461)\u306b\u3088\u3063\u3066\u4fb5\u5bb3\u3055\u308c\u305f\u3053\u3068\u3092\u78ba\u8a8d\u3057\u305f\u3068\u767a\u8868\u3057\u307e\u3057\u305f\u3002 Cisco\u306e\u88fd\u54c1\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u30c1\u30fc\u30e0(PSIRT)\u306f20", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvkjlv7fnt2n"}, {"timestamp": "2026-09-15T11:55:08.612Z", "date_only": false, "value": "2026-09-15T11:55:08.612230Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvkktvplnjut", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "48cab615-ba7a-4dfb-a145-cb5a93487115", "content": "Cisco $CSCO warns that CVE-2026-76461 in Secure Email Gateway is being actively exploited. Software updates are available; Cisco says there is no workaround.", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvkktvplnjut"}, {"timestamp": "2026-09-15T12:05:07.065Z", "date_only": false, "value": "2026-09-15T12:05:07.065705Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvkliblu3e23", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "04443aec-3253-4155-b245-ddfbb45fc81b", "content": "\ud83d\udd17 CVE : CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443, CVE-2026-76461", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvkliblu3e23"}, {"timestamp": "2026-09-15T12:39:18.282Z", "date_only": false, "value": "2026-09-15T12:39:18.282085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mvknfbksc22n", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "e636c0f4-06f3-442d-95af-eaeb446111e7", "content": "Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)\n\nwww.helpnetsecurity.com/2026/09/15/c...\n\n#Kyberturvallisuus #Kyber #Tilannekuva", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mvknfbksc22n"}, {"timestamp": "2026-09-15T12:45:13.362Z", "date_only": false, "value": "2026-09-15T12:45:13.362331Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mvknpyeph42l", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "2843e5f7-e10d-4044-be84-a8744b484526", "content": "CVE-2026-76461: SQLi in Cisco AsyncOS lets unauthenticated attackers execute OS commands as root. In KEV as of Sept. 14\u2026 https://0daynews.com/articles/2026-09-15-cisco-secure-email-gateway-cve-2026-76461-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-2082", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mvknpyeph42l"}, {"timestamp": "2026-09-15T12:47:32.497Z", "date_only": false, "value": "2026-09-15T12:47:32.497", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76461", "record": "FKIE_CVE-2026-76461", "field": "lastModified"}, {"timestamp": "2026-09-15T13:00:05.510Z", "date_only": false, "value": "2026-09-15T13:00:05.510753Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/102359", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "58df1497-80fe-492c-8d46-e946dc6e723f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-76461\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HORKimhab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-15 06:13:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-76461 - Draft or TODO\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/102359"}, {"timestamp": "2026-09-15T13:16:18.390Z", "date_only": false, "value": "2026-09-15T13:16:18.390388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvkphlll2a2j", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "af0d8cda-7307-41d1-953e-9da21ae5b6ef", "content": "Cisco Secure Email Gateway CVE-2026-76461 (CVSS 9.8) lets a crafted inbound email execute commands as root on the appliance \u2014 apply Cisco's advisory updates immediately. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvkphlll2a2j"}, {"timestamp": "2026-09-15T13:16:34.035Z", "date_only": false, "value": "2026-09-15T13:16:34.035582Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mvkpi2ajph2q", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "bf92df24-4b26-44aa-8807-5f08f0e08742", "content": "Cisco has issued a warning about a zero-day vulnerability (CVE-2026-76461) in its Secure Email Gateway that allows remote attackers to execute arbitrary commands with root privileges. The flaw arises from a parsing issue in AsyncOS Software, enabling exploitation via malicious emails.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mvkpi2ajph2q"}, {"timestamp": "2026-09-15T15:26:00.320Z", "date_only": false, "value": "2026-09-15T15:26:00.320790Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/approximately.bsky.social/post/3mvkwpimwu42a", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "2e330da7-f520-41a9-b105-fc1fb869602b", "content": "Cisco Secure Email Gateway\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\u3001\u60aa\u7528\u78ba\u8a8d\u3067CISA\u304c\u91cd\u5927\u30ea\u30b9\u30af\u3068\u8a55\u4fa1\nCisco\u306e\u30e1\u30fc\u30eb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u88fd\u54c1\u300cSecure Email Gateway\u300d\u306bCVSS\u30b9\u30b3\u30a29.8\u306e\u6df1\u523b\u306aSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u304c\u898b\u3064\u304b\u308a\u3001JPCERT/CC\u304c\u7dca\u6025\u60c5\u5831\u3092\u767a\u8868\u3057\u305f\u3002\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u3067\u3001root\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002Cisco\u306f2026\u5e749\u6708\u306b\u60aa\u7528\u3092\u78ba\u8a8d\u2026\nhttps://internet.watch.impress.co.jp/docs/news/2141091.html", "url": "https://bsky.app/profile/approximately.bsky.social/post/3mvkwpimwu42a"}, {"timestamp": "2026-09-15T16:00:01Z", "date_only": false, "value": "2026-09-15T16:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-76461", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "a16cbb03-0793-4e02-8eba-a5b7659656d1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-15T16:00:30.357Z", "date_only": false, "value": "2026-09-15T16:00:30.357044Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a16cbb03-0793-4e02-8eba-a5b7659656d1", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "c2c03308-7817-45bc-99ba-61bbca310758", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a16cbb03-0793-4e02-8eba-a5b7659656d1", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T16:00:54.445Z", "date_only": false, "value": "2026-09-15T16:00:54.445461Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mvkyntjqi42x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "c45a4c45-f860-4a9e-b55b-14039e19799b", "content": "Nieuwe kwetsbaarheid in Cisco e-mail gateway maakt commando-uitvoering met root-\n\nEen ernstige zero-day kwetsbaarheid, bekend onder de identificatie CVE-2026-76461, is aangetroffen in de Cisco Secure Email Gateway. Deze kwetsbaarheid is actief uitgebuit voordat Cisco op maandag 14 september ...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mvkyntjqi42x"}, {"timestamp": "2026-09-15T16:02:24.288Z", "date_only": false, "value": "2026-09-15T16:02:24.288234Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvkyow55r4fd", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "bf9c583e-e4ae-4d00-a346-e10457497d97", "content": "Cisco $CSCO reports active exploitation of CVE-2026-76461 in Secure Email Gateway. Updates are available; Cisco says there is no workaround. AI-generated presenter and voice.", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvkyow55r4fd"}, {"timestamp": "2026-09-15T16:04:55.725Z", "date_only": false, "value": "2026-09-15T16:04:55.725206Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvkyv47d6y2m", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "9480e528-b48e-477a-bfc8-1b1c2cc5c599", "content": "Cisco\u3001\u30e1\u30fc\u30eb\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u3067\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u9867\u5ba2\u306b\u8b66\u544a\n\n\u51fa\u6240\u3084\u52d5\u6a5f\u304c\u4e0d\u660e\u306a\u653b\u6483\u8005\u304c\u3001Cisco Secure Email Gateway\u306e\u6df1\u523b\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3066\u3044\u308b\u3068\u3001\u5f53\u5c40\u3068\u7814\u7a76\u8005\u304c\u6708\u66dc\u65e5\u306b\u660e\u3089\u304b\u306b\u3057\u307e\u3057\u305f\u3002 \u3053\u306e\u8106\u5f31\u6027\u2014\u2014CVE-2026-76461\u2014\u2014\u306f\u3001Cisco\u304c\u6708\u66dc\u65e5\u306b\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u30d1\u30c3\u30c1\u3092\u63d0\u4f9b\u3059\u308b\u4ee5\u524d\u304b\u3089\u60aa\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u8a8d\u8a3c\u3092\u7d4c\u3066\u3044\u306a\u3044\u9060\u9694\u306e\u653b\u6483\u8005\u304c\u8106", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvkyv47d6y2m"}, {"timestamp": "2026-09-15T16:16:34.770Z", "date_only": false, "value": "2026-09-15T16:16:34.770410Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/09/kritisk-sarbarhet-i-cisco-secure-email-gateway-utnyttjas-aktivt.html", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "1b9ccdd4-45f6-4021-adeb-9a8901dfb67f", "url": "https://www.cert.se/2026/09/kritisk-sarbarhet-i-cisco-secure-email-gateway-utnyttjas-aktivt.html"}, {"timestamp": "2026-09-15T16:16:40.976Z", "date_only": false, "value": "2026-09-15T16:16:40.976603Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucke-in-cisco-secure-email-gateway-aktiv-ausgenutzt-updates-verfugbar", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "ea70de3f-2d16-4cb4-aa32-08a1a7a3df2c", "url": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucke-in-cisco-secure-email-gateway-aktiv-ausgenutzt-updates-verfugbar"}, {"timestamp": "2026-09-15T16:20:18.536Z", "date_only": false, "value": "2026-09-15T16:20:18.536157Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvkzqmf7rx2o", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "f442cdbd-fd2c-447e-b639-eca5e162a00d", "content": "@sophossecurity.bsky.social\nCritical SQL injection is under active exploitation, enabling unauthenticated remote root command execution.\n-\nIOCs: CVE-2026-76461\n-\n#CVE202676461 #KEV #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mvkzqmf7rx2o"}, {"timestamp": "2026-09-15T16:25:56.046Z", "date_only": false, "value": "2026-09-15T16:25:56.046611Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mvl22ncsvn2l", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "cbfbad4f-eabf-40b1-8246-74667913b478", "content": "Actionable C-Suite threat intelligence and mitigation strategies for CVE-2026-76461, addressing active SQL injection exploitation vectors within enterprise Cisco Secure Email Gateway infrastructures. https://thecybermind.co/r5ry", "url": "https://bsky.app/profile/thecybermind.co/post/3mvl22ncsvn2l"}, {"timestamp": "2026-09-15T17:05:15.384Z", "date_only": false, "value": "2026-09-15T17:05:15.384818Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mvl4axu3md2x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "5e5da2ae-fa85-45a8-bfe0-e25c738121a6", "content": "Cisco's email gateway kindly grants unauthenticated visitors complete root access through CVE-2026-76461. Just another Tuesday in IT.\n\n#CiscoFail #RootAccess", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mvl4axu3md2x"}, {"timestamp": "2026-09-15T17:05:18.717Z", "date_only": false, "value": "2026-09-15T17:05:18.717123Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mvl4b26dok2g", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d0026acf-b122-47ea-b300-edf568358750", "content": "Here we go again with Cisco Secure Email Gateway operators discovering unauthenticated prowlers can grab root privileges via CVE-2026-76461. Our delightful underlying OS environments bear the brunt of these arbitrary command antics whilst being actively exploited in the wild. Shi...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mvl4b26dok2g"}, {"timestamp": "2026-09-15T17:13:08.960Z", "date_only": false, "value": "2026-09-15T17:13:08.960113Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvl4p3mdc52f", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "a7b35af1-bf5a-4713-8464-b364d824869b", "content": "Cisco patches critical, actively exploited zero-day (CVE-2026-76461) in Secure Email Gateways. Unauthenticated attackers can compromise devices via a crafted email. CISA has added it to the KEV catalog. #CyberSecurity #ZeroDay #Infosec #Cisco\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mvl4p3mdc52f"}, {"timestamp": "2026-09-15T17:37:07.495Z", "date_only": false, "value": "2026-09-15T17:37:07.495673Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvl5zxskm32b", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "e7885aa5-17ae-45f8-a800-16c62af998ac", "content": "\ud83d\udccc Critical Zero-Day Vulnerability CVE-2026-76461 in Cisco Secure Email Gateway Under Active Exploitati... https://www.cyberhub.blog/article/32124-critical-zero-day-vulnerability-cve-2026-76461-in-cisco-secure-email-gateway-under-active-exploitation", "url": "https://bsky.app/profile/cyberhub.blog/post/3mvl5zxskm32b"}, {"timestamp": "2026-09-15T20:25:19.362Z", "date_only": false, "value": "2026-09-15T20:25:19.362853Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvlhgpcz6d22", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "a2c0dc14-175c-4db9-be02-3ada7ec7fa73", "content": "CVE-2026-76461 in Cisco Secure Email Gateway enables unauthenticated remote attackers to execute arbitrary commands as root; patch immediately and check logs for SQL probes.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mvlhgpcz6d22"}, {"timestamp": "2026-09-15T20:25:20.674Z", "date_only": false, "value": "2026-09-15T20:25:20.674038Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvlhgr2smp2l", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "68d11086-7d68-48f7-a841-a7516cf33943", "content": "CVE-2026-76461 in Cisco Secure Email Gateway enables unauthenticated remote attackers to execute arbitrary commands as root; patch immediately and check logs for SQL probes.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvlhgr2smp2l"}, {"timestamp": "2026-09-15T20:25:40.514Z", "date_only": false, "value": "2026-09-15T20:25:40.514300Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvlhhct7sn25", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "2ee5626a-88a8-4d37-ab18-30cc87178099", "content": "CVE-2026-76461 in Cisco Secure Email Gateway enables unauthenticated remote attackers to execute arbitrary commands as root; patch immediately and check logs for SQL probes.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvlhhct7sn25"}, {"timestamp": "2026-09-15T20:45:02.116Z", "date_only": false, "value": "2026-09-15T20:45:02.116876Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-cisco-secure-email-gateway-sql-injection-vulnerability-patch-immediately", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d1c2723e-8f7b-442e-9aed-4f1ae30b762b", "url": "https://ccb.belgium.be/advisories/warning-cisco-secure-email-gateway-sql-injection-vulnerability-patch-immediately"}, {"timestamp": "2026-09-15T22:00:26.863Z", "date_only": false, "value": "2026-09-15T22:00:26.863441Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvlmqt7ps724", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "a6e5397b-4b48-43ee-bbb2-31028ae90b09", "content": "Cisco warns of active exploitation of CVE-2026-76461, a critical zero-day in Secure Email Gateway enabling unauthenticated root command execution. CISA has added it to the Known Exploited Vulnerabilities list. #Cisco #CVE202676461 #CISA", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvlmqt7ps724"}, {"timestamp": "2026-09-16T00:08:02.894Z", "date_only": false, "value": "2026-09-16T00:08:02.894282Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mvltuxv5rc2i", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "49942034-5bbe-4345-9dcb-dbe63a2bd479", "content": "Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERTCC \uff08Sep 15\uff09\n\nwww.jpcert.or.jp/at/2026/at26...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mvltuxv5rc2i"}, {"timestamp": "2026-09-16T01:00:38.228Z", "date_only": false, "value": "2026-09-16T01:00:38.228795Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucke-in-cisco-secure-email-gateway-aktiv-ausgenutzt-updates-verfugbar", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "8ccaa69c-4557-4146-b54b-b70939a234df", "content": "15. September 2026\n\nBeschreibung\n\nIn Cisco Secure Email Gateway existiert eine kritische Sicherheitslücke. Bei erfolgreicher Ausnutzung könnte diese Sicherheitslücke es nicht authentifizierten Angreifer:innen aus der Ferne ermöglichen Befehle mit Root-Rechten auf dem zugrunde liegenden Betriebssystem auszuführen. Laut Cisco wurde eine Ausnutzung der Sicherheitslücke bereits beobachtet.\n\nCVE-Nummer(n): CVE-2026-76461\n\nCVSS Base Score: 9.8\n\nAuswirkungen\n\nEin Angreifer könnte diese Sicherheitslücke ausnutzen, indem er eine speziell präparierte E-Mail-Nachricht mit bösartigen SQL-Anweisungen an eine betroffene Instanz sendet. Ein erfolgreicher Angriff könnte es Angreifern ermöglichen, beliebige SQL-Anweisungen auszuführen und die betroffenen Instanzen zu kompromittieren.\n\nBetroffene Systeme\n\nBetroffen ist Cisco AsyncOS for Cisco Secure Email Gateway (physisch und virtuell):\n\n\n\n<15.5.5-014\n\n<16.0.4-302\n\n<16.5.0-780\n\n\nLaut Cisco sind Secure Email and Web Manager und Secure Web Appliance nicht betroffen.\n\nAbhilfe\n\nCisco stellt Updates bereit, die die Sicherheitslücke schließen. Bei Anzeichen einer Kompromittierung empfiehlt Cisco, davor einen sauberen Punkt der Instanz wiederherzustellen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCisco Security Advisory 14.09.2026: Cisco Secure Email Gateway SQL Injection Vulnerabilityhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "url": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucke-in-cisco-secure-email-gateway-aktiv-ausgenutzt-updates-verfugbar"}, {"timestamp": "2026-09-16T02:07:08.393Z", "date_only": false, "value": "2026-09-16T02:07:08.393738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvm2jw7nr725", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "ae7713f5-3b6e-4656-912a-8a40ecc64f0b", "content": "\ud83d\udccc CVE-2026-76461 - A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execu... https://www.cyberhub.blog/cves/CVE-2026-76461", "url": "https://bsky.app/profile/cyberhub.blog/post/3mvm2jw7nr725"}, {"timestamp": "2026-09-16T02:18:50.420Z", "date_only": false, "value": "2026-09-16T02:18:50.420045Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mvm36umfad2k", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "769630ee-ff95-4224-a67a-d22a2b11ee5a", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-76461) Cisco Secure Email Gateway Root RCE via Email Parsing\".\n\n#cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X", "url": "https://bsky.app/profile/opsmatters.com/post/3mvm36umfad2k"}, {"timestamp": "2026-09-16T04:00:05.270Z", "date_only": false, "value": "2026-09-16T04:00:05.270763Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/2959", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "aea745be-9321-4264-972d-9e7a4b9b9674", "content": "Cisco Warns of Actively Exploited Zero-Day in Secure Email Gateway \u2014 CVE-2026-76461 allows unauthenticated root command execution via a crafted email; CISA sets a Sept. 17 deadline.", "url": "https://t.me/CyberDispatch/2959", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-16T04:00:05.333Z", "date_only": false, "value": "2026-09-16T04:00:05.333606Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/2946", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "b2021435-d6d0-46b2-b637-f66a3f4e5cbd", "content": "Attackers are exploiting a Cisco Secure Email Gateway vulnerability that can let a crafted email trigger command execution as root.\n\nCisco has released fixes, and CISA added CVE-2026-76461 to its KEV catalog.", "url": "https://t.me/CyberDispatch/2946", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-16T05:05:26.782Z", "date_only": false, "value": "2026-09-16T05:05:26.782134Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/digitalpulsebrief.bsky.social/post/3mvmeirhdw32f", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "f1fa3615-248b-4f29-8f37-5857f6fb08b4", "content": "Cisco Secure Email Gateway Zero-Day: CVE-2026-76461 Patch\u00a0Guide\n\nCisco Secure Email Gateway zero-day CVE-2026-76461 is under active exploitation. See affected versions, fixed releases, detection guidance and a practical 7-step response checklist.", "url": "https://bsky.app/profile/digitalpulsebrief.bsky.social/post/3mvmeirhdw32f"}, {"timestamp": "2026-09-16T05:59:24.344Z", "date_only": false, "value": "2026-09-16T05:59:24.344781Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mvmhjbkd5t22", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "daa93836-2421-4d78-94b7-b4a51eeb7d1c", "content": "\ud83c\uddeb\ud83c\uddf7 CERT-FR : Apple (RCE, \u00e9l\u00e9v. de privil\u00e8ges) et Cisco (RCE, SQLi, CVE-2026-76461 exploit\u00e9e).\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1172/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mvmhjbkd5t22"}, {"timestamp": "2026-09-16T06:17:28.847Z", "date_only": false, "value": "2026-09-16T06:17:28.847718Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvmijlhhmn24", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "2e819d2b-069a-44e1-876f-446b4d4f37bf", "content": "A critical Cisco Secure Email Gateway vulnerability allows unauthenticated attackers to gain root access via a single email. Learn about CVE-2026-76461.\n\n#Cisco #EmailGateway #CyberSecurity #ZeroDay #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mvmijlhhmn24"}, {"timestamp": "2026-09-16T06:28:29.756Z", "date_only": false, "value": "2026-09-16T06:28:29.756575Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/calculito.bsky.social/post/3mvmj5bypdu2f", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "22958da9-721e-4bb2-8612-b531f6419a68", "content": "\ud83d\udd34 Cisco\u2019s Secure Email Gateway had a hole: anyone who could reach it could run commands as root, with no password. Cisco patched CVE-2026-76461. Until then, an email security box was effectively a remote-control panel for attackers. \u201cSecure\u201d was the label, not the condition. No\u2026", "url": "https://bsky.app/profile/calculito.bsky.social/post/3mvmj5bypdu2f"}, {"timestamp": "2026-09-16T06:39:46.534Z", "date_only": false, "value": "2026-09-16T06:39:46.534522Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvmjrhg5az2k", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "3f6fd156-d924-4332-a394-c3568eaadf81", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 40 interactions\nCVE-2026-20079: 24 interactions\nCVE-2026-85880: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85706: 19 interactions\nCVE-2026-58231: 4 interactions\nCVE-2026-76461: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mvmjrhg5az2k"}, {"timestamp": "2026-09-16T07:15:55.547Z", "date_only": false, "value": "2026-09-16T07:15:55.547241Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmls2prbb2i", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "9ed78399-70c9-4d22-9fd9-23c8a2e959f3", "content": "Cisco Secure Email Gateway CVE-2026-76461 critical SQL injection can lead to root on ESA appliances \u2014 apply Cisco updates released 2026-09-14 now. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmls2prbb2i"}, {"timestamp": "2026-09-16T07:46:12.713Z", "date_only": false, "value": "2026-09-16T07:46:12.713166Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvmnib44js2d", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "7841b956-adc5-4192-a30d-8eb37e669df9", "content": "Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)\n\nAttackers have leveraged a zero-day SQL injection vulnerability (CVE-2026-76461) to compromise Cisco Secure Email Gateway appliances, Cisco confirmed on Monday. The vendor\u2019s Product Security Incident Respons\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvmnib44js2d"}, {"timestamp": "2026-09-16T08:15:14.887Z", "date_only": false, "value": "2026-09-16T08:15:14.887326Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvmp45v7fe2c", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "71150d33-ce86-4b23-800d-af4b24b4bbe1", "content": "\ud83d\udcf0 Cisco Rilis Patch untuk Zero-Day Secure Email Gateway yang Aktif Dieksploitasi\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/16/cisco-secure-email-gateway-zero-day-cve-2026-76461/\n\n#cisco #cybersecurity #dataSecurity #emailSecurity #keamananSiber #malware #vulnerability #zer", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvmp45v7fe2c"}, {"timestamp": "2026-09-16T08:45:11.017Z", "date_only": false, "value": "2026-09-16T08:45:11.017150Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-09-16/Cisco-advarer-om-aktivt-udnyttet-0-dagssaarbarhed-i-mailgateways", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "1d7766b2-01eb-401d-ae0f-b80fc503b53d", "url": "https://www.cert.dk/news/2026-09-16/Cisco-advarer-om-aktivt-udnyttet-0-dagssaarbarhed-i-mailgateways"}, {"timestamp": "2026-09-16T09:03:29.340Z", "date_only": false, "value": "2026-09-16T09:03:29.340380Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mvmrsg7z4l2r", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "b62f2234-d7cd-41c9-8fec-ec1d28ea53ce", "content": "Cisco email gateway rooted by an email \ud83d\udea8\n\nCisco Secure Email Gateway has a critical flaw (CVE-2026-76461) allowing root access via a malicious email, with active exploitation underway.\n\nEmail security should probably be more secure than that.", "url": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mvmrsg7z4l2r"}, {"timestamp": "2026-09-16T11:52:39.223Z", "date_only": false, "value": "2026-09-16T11:52:39.223704Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvn3aw4lyc2d", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "fb64ee0a-2aa2-4ba2-a4f5-f5e9cdbceaec", "content": "Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day\n\nCisco warns of a critical zero-day in Secure Email Gateway, exploited in the wild to gain root access through malicious emails. Cisco disclosed a critical zero-day, tracked as CVE-2026-76461 (CVSS score of 9.8\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvn3aw4lyc2d"}, {"timestamp": "2026-09-16T12:26:30.161Z", "date_only": false, "value": "2026-09-16T12:26:30.161685Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mvn552lu2c2x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "82880ff0-170f-4e2a-a463-31dd436ecff3", "content": "Cisco patches actively exploited email gateway zero-day (CVE-2026-76461) - Help Net Security www.helpnetsecurity.com/2026/09/15/c...", "url": "https://bsky.app/profile/pvynckier.bsky.social/post/3mvn552lu2c2x"}, {"timestamp": "2026-09-16T13:14:47.187Z", "date_only": false, "value": "2026-09-16T13:14:47.187824Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gadgetchecks.bsky.social/post/3mvn7trnxrd24", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "e6a4cfee-a882-4229-9e9b-2303e5c4fa75", "content": "CISCO SECURE EMAIL GATEWAY: CVE-2026-76461 WIRD AKTIV AUSGENUTZT\n\nhttps://gadgetchecks.de/cisco-secure-email-gateway-cve-2026-76461-wird-aktiv-ausgenutzt/\n\n#technikaktuell #cisco #cybersicherheit #sicherheitsl\u00fccke #emailsecurity #gadgetchecks", "url": "https://bsky.app/profile/gadgetchecks.bsky.social/post/3mvn7trnxrd24"}, {"timestamp": "2026-09-16T14:06:14.411Z", "date_only": false, "value": "2026-09-16T14:06:14.411218Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mvncprrjhu2j", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "0c623f18-af52-4e87-8eea-ecdef66b54f6", "content": "One crafted email gives root on Cisco Secure Email Gateway. CVE-2026-76461 is under active exploitation. Patch the edge you can't take offline.\n#ThreatIntel #CriticalInfrastructure\nhttps://threat-intelligence.redeyesecurity.com/blog/cisco-secure-email-gateway-cve-2026-76461-root-rce-2026", "url": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mvncprrjhu2j"}, {"timestamp": "2026-09-16T15:42:13.693Z", "date_only": false, "value": "2026-09-16T15:42:13.693115Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/inferlume.bsky.social/post/3mvni3e5vsc2r", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "455096bb-58ad-45e7-9ffc-9cdc9a99ddd2", "content": "One crafted email can be root on Cisco Secure Email Gateway CVE-2026-76461. ScreenConnect sessions, FMC managers, and a Chrome chain share the same night.\n\nFull Inferlume Report: inferlume.com/reports/dail...\n\n#CyberSecurity #CTI #CISA #Cisco #KEV #ThreatIntelligence", "url": "https://bsky.app/profile/inferlume.bsky.social/post/3mvni3e5vsc2r"}, {"timestamp": "2026-09-16T16:00:03.537Z", "date_only": false, "value": "2026-09-16T16:00:03.537607Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bdufstecru/3459", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "5661351d-e42f-4796-9f80-8440046a80ee", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Cisco AsyncOS \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b Cisco Secure Email \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u0430 SQL. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\n\nBDU:2026-14615\nCVE-2026-76461\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0432\u0435\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442);\n- \u0430\u043d\u0430\u043b\u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0436\u0443\u0440\u043d\u0430\u043b\u0430 mail_logs \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0443\u0442\u0435\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \"cisco-esa> grep -i \"COPY.*TO PROGRAM\" [\u0438\u043c\u044f \u0444\u0430\u0439\u043b\u0430 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e: mail_logs]\";\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f (\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438) \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438;\n- \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.", "url": "https://t.me/bdufstecru/3459"}, {"timestamp": "2026-09-16T16:03:47.074Z", "date_only": false, "value": "2026-09-16T16:03:47.074726Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117281562596675005", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "afe65fd2-f63d-4d14-b150-20de46931c1f", "content": "\ud83d\udcf0 Cisco Patches Actively Exploited Zero-Day in Secure Email Gateways\nCisco patches critical, actively exploited zero-day (CVE-2026-76461) in Secure Email Gateways. Unauthenticated attackers can compromise devices via a crafted email. CISA has added it to the KEV catalog. #CyberSecurity #ZeroDay #Infosec #Cisco\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisco-patches-actively-exploited-zero-day-in-secure-email-gateway/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117281562596675005"}, {"timestamp": "2026-09-16T16:04:19.400Z", "date_only": false, "value": "2026-09-16T16:04:19.400511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjcxgtgo2f", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "2a61b3be-f8c5-43f9-ba76-141a37234830", "content": "Cisco patches critical, actively exploited zero-day (CVE-2026-76461) in Secure Email Gateways. Unauthenticated attackers can compromise devices via a crafted email. CISA has added it to the KEV catalog. #CyberSecurity #ZeroDay #Infosec #Cisco\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjcxgtgo2f"}, {"timestamp": "2026-09-16T18:41:13.054Z", "date_only": false, "value": "2026-09-16T18:41:13.054450Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/endoflife.ai/post/3mvns3iprrq25", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "809dc0ca-bfce-4977-8306-e61aaec1d0ef", "content": "\ud83d\udcd6 New from endoflife.ai:\n\nCisco Secure Email Gateway CVE-2026-76461: Root by Email, Due Sep 17\n\nhttps://endoflife.ai/article-cisco-secure-email-gateway-cve-2026-76461", "url": "https://bsky.app/profile/endoflife.ai/post/3mvns3iprrq25"}, {"timestamp": "2026-09-16T23:32:50.284Z", "date_only": false, "value": "2026-09-16T23:32:50.284453Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mvocewqqdo2o", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "b91172d9-fcfe-493d-a3fb-d5f6a8c3a7ca", "content": "Cisco alerts for CVE-2026-76461, a critical flaw (CVSS 9.8) in AsyncOS for Secure Email Gateway. Active exploitation risks remote, unauthenticated attacks. Update now!", "url": "https://bsky.app/profile/technoholic.bsky.social/post/3mvocewqqdo2o"}, {"timestamp": "2026-09-17T00:00:00Z", "date_only": true, "value": "2026-09-17", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "evidence.0.details.due_date", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-17T00:00:00Z", "date_only": false, "value": "2026-09-17T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1175", "record": "CERTFR-2026-AVI-1175", "field": "last_revision_date"}, {"timestamp": "2026-09-17T00:00:00Z", "date_only": false, "value": "2026-09-17T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1175", "record": "CERTFR-2026-AVI-1175", "field": "revisions.1.revision_date"}, {"timestamp": "2026-09-17T03:41:51.839Z", "date_only": false, "value": "2026-09-17T03:41:51.839414Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mvoqcajwai2z", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "fd212d07-bee0-43cf-adec-66d2e8a7b76f", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-70756) Oracle WebLogic Server Takeover via T3 and IIOP\" and \"Emerging Threat: (CVE-2026-76461) Cisco Secure Email Gateway Root RCE via Email Parsing\".\n \n#cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X", "url": "https://bsky.app/profile/opsmatters.com/post/3mvoqcajwai2z"}, {"timestamp": "2026-09-17T04:01:13.131Z", "date_only": false, "value": "2026-09-17T04:01:13.131778Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvoretoyrg2p", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "fb10da80-ceb3-4be5-b964-0ea8bfa3d5b6", "content": "~Arcticwolf~\nUnauthenticated attackers actively exploit Cisco Secure Email Gateway to execute root code via crafted email; patch now.\n-\nIOCs: CVE-2026-76461\n-\n#CVE202676461 #Cisco #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mvoretoyrg2p"}, {"timestamp": "2026-09-17T04:43:13.461Z", "date_only": false, "value": "2026-09-17T04:43:13.461473Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mvotpxt4yc2p", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "f480e02c-8de5-49c2-9046-1890d80adf50", "content": "The latest update for #ArcticWolf includes \"CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required\" and \"We Need to Pace AI Development. We Can't Pace AI Defense\".\n \n#cybersecurity #infosec #networks https://opsmtrs.com/2ZFbaTl", "url": "https://bsky.app/profile/opsmatters.com/post/3mvotpxt4yc2p"}, {"timestamp": "2026-09-17T06:36:26.275Z", "date_only": false, "value": "2026-09-17T06:36:26.275838Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvp22ftku72p", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "83f05d76-1f0c-4c9f-9643-35ac6247cd47", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 48 interactions\nCVE-2026-76461: 16 interactions\nCVE-2026-82078: 15 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-76460: 10 interactions\nCVE-2026-91843: 9 interactions\nCVE-2026-76461: 8 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mvp22ftku72p"}, {"timestamp": "2026-09-17T08:00:10.951Z", "date_only": false, "value": "2026-09-17T08:00:10.951940Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mvp6q52sfh2w", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "dbdd09c9-c7e5-426d-9a0f-3be049e5c69d", "content": "Cisco confirms active exploitation: CVE-2026-76461 (CVSS 9.8) grants ROOT access via one crafted email, no login needed. AsyncOS Secure Email Gateway. CISA KEV deadline Sep 17. Patch to 16.5.0-780 now. \ndiesec.com/2026/09/cisc...\ndiesec.com/de/2026/09/c... \n#Cisco #EmailSecurity #CyberSecurity", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mvp6q52sfh2w"}, {"timestamp": "2026-09-17T11:00:04.615Z", "date_only": false, "value": "2026-09-17T11:00:04.615011Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3154", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "b55789cd-8c26-42de-ac92-2050b57d29fa", "content": "\ud83d\udd34 Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation\n\nCisco warned customers on Monday that a zero-day vulnerability affecting Secure Email Gateway appliances has been exploited in the wild.\n\nThe vulnerability is identified as CVE-2026-76461 and has a CVSS score of 9.8. Cisco describes it as an email parsing issue in AsyncOS software that can be exploited remotely and without authentication to execute arbitrary commands on the underlying operating system with root privileges.\n\nThe tech giant explained that the critical flaw can be exploited to execute malicious SQL statements by sending them to the targeted user inside a specially crafted email.", "url": "https://t.me/pphm_HackerNews/3154"}, {"timestamp": "2026-09-17T11:00:28.578Z", "date_only": false, "value": "2026-09-17T11:00:28.578342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mvpishe3nk2y", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "8216d121-29c9-4e42-84ea-de6305329320", "content": "CVE-2026-76461, un courriel pi\u00e9g\u00e9 suffit \u00e0 prendre la main sur les passerelles de messagerie de Cisco - IT SOCIAL itsocial.fr/cybersecurit...", "url": "https://bsky.app/profile/pvynckier.bsky.social/post/3mvpishe3nk2y"}, {"timestamp": "2026-09-17T14:00:03.476Z", "date_only": false, "value": "2026-09-17T14:00:03.476183Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/xakep_ru/20069", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "69e452e7-f487-4e0c-b851-438a6241a92b", "content": "\u0428\u043b\u044e\u0437\u044b Cisco Secure Email Gateway \u043c\u043e\u0436\u043d\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b Cisco \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Secure Email Gateway \u2014 \u0448\u043b\u044e\u0437\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u043e\u0447\u0442\u0443 \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439. \u0418\u0440\u043e\u043d\u0438\u0447\u043d\u043e, \u043d\u043e \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u0448\u043b\u044e\u0437\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u0430 \u0435\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 root-\u043f\u0440\u0430\u0432\u0430.\n\nhttps://xakep.ru/2026/09/17/cve-2026-76461/", "url": "https://t.me/xakep_ru/20069"}, {"timestamp": "2026-09-17T14:53:18.742Z", "date_only": false, "value": "2026-09-17T14:53:18.742646Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mvpvsvdfvp2k", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "6c562a39-a547-48c9-a835-d78cba992f0e", "content": "CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required\n\n", "url": "https://bsky.app/profile/arc-codex.com/post/3mvpvsvdfvp2k"}, {"timestamp": "2026-09-17T16:25:53.047Z", "date_only": false, "value": "2026-09-17T16:25:53.047313Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mvq2yfp33u24", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "02cbf89f-f9fb-40e6-8f25-4bbe62308e3d", "content": "CVE-2026-76461: Critical Cisco Secure Email Gateway Zero\n\nThe strongest version of this narrative is a vital security alert: a high-severity vulnerability is being actively exploited, and immediate patching is the only viable defense. The technical details p\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mvq2yfp33u24"}, {"timestamp": "2026-09-17T16:47:12Z", "date_only": false, "value": "2026-09-17T16:47:12+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-17T16:47:12Z", "date_only": false, "value": "2026-09-17T16:47:12+00:00", "kind": "other", "label": "Updated", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-17T20:15:55.891Z", "date_only": false, "value": "2026-09-17T20:15:55.891228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mvqhtr5ilc2w", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d2a4e8a0-ee76-4af5-a491-1f72e4fceaa1", "content": "\ud83d\udce1 Cisco's Back-to-Back Zero-Days: CVE-2026-76461 (Secure Email Gateway) and CVE-2026-76460 (ISE Auth Bypass)", "url": "https://bsky.app/profile/insomnisec.bsky.social/post/3mvqhtr5ilc2w"}, {"timestamp": "2026-09-17T21:32:03.401Z", "date_only": false, "value": "2026-09-17T21:32:03.401471Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/5738ebbe4fe65a83506d69bc23a110ab", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "873c3c14-e722-4499-a647-91554c269b5a", "content": "# CVE-2026-76461: CVE-2026-76461: SQL Injection to Remote Code Execution in Cisco Secure Email Gateway\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76461\n\n## Summary\nCVE-2026-76461 is a critical, unauthenticated, remotely exploitable SQL Injection (SQLi) vulnerability in the email parsing engine of Cisco AsyncOS Software for Cisco Secure Email Gateway (SEG). An unauthenticated remote attacker can exploit this vulnerability by transmitting a specially crafted email message containing malicious SQL statements directly through an affected gateway.\n\n## TL;DR\nAn unauthenticated remote SQL injection vulnerability in Cisco Secure Email Gateway allows attackers to execute arbitrary system commands as root via crafted SMTP traffic.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS Score**: 9.8 (Critical)\n- **CISA KEV Status**: Listed (September 14, 2026)\n- **Exploit Status**: Active exploitation in the wild\n- **Platform**: Cisco AsyncOS (FreeBSD-based)\n\n## Affected Systems\n\n- Cisco Secure Email Gateway (Physical Hardware Appliances: C170, C195, C380, C390, C395, C680, C690, C690X, C695)\n- Cisco Secure Email Gateway Virtual (C100V, C300V, C600V)\n- Cisco Content Security Management Appliance (M170)\n- **AsyncOS Software for Cisco Secure Email Gateway**: < 15.5.5-014 (Fixed in: `15.5.5-014`)\n- **AsyncOS Software for Cisco Secure Email Gateway**: 16.0.0 to < 16.0.4-302 (Fixed in: `16.0.4-302`)\n- **AsyncOS Software for Cisco Secure Email Gateway**: 16.5.0 < 16.5.0-780 (Fixed in: `16.5.0-780`)\n\n## Mitigation\n\n- Apply official Cisco AsyncOS Software updates immediately.\n- Redeploy virtual appliances from clean, patched images if compromise is suspected.\n- Rotate all administrative credentials, API tokens, and SSH keys post-upgrade.\n\n**Remediation Steps:**\n1. Verify the current running version of Cisco AsyncOS via the CLI command 'version' or the administrative Web UI.\n2. Download and install the appropriate patched release (15.5.5-014, 16.0.4-302, or 16.5.0-780) from the Cisco Software Central portal.\n3. Reboot the appliance to finalize the installation of the security patch.\n4. Audit the system logs using 'grep -i \"COPY.*TO PROGRAM\" [mail_logs]' to identify potential historic indicators of compromise.\n\n## References\n\n- [Cisco Security Advisory: Cisco Secure Email Gateway SQL Injection Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX)\n- [NVD - CVE-2026-76461](https://nvd.nist.gov/vuln/detail/CVE-2026-76461)\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461)\n- [CVE-2026-76461 Detection Kit GitHub Repository](https://github.com/fevar54/CVE-2026-76461-Detection-Kit-)\n- [CVE-2026-76461 GitHub Analysis](https://github.com/0xBlackash/CVE-2026-76461)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76461) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/5738ebbe4fe65a83506d69bc23a110ab"}, {"timestamp": "2026-09-18T00:00:05.974Z", "date_only": false, "value": "2026-09-18T00:00:05.974937Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/xakep_ru/20069", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "75ecf4dd-ce5e-4b60-975e-cbd17cfdbf39", "content": "\u0428\u043b\u044e\u0437\u044b Cisco Secure Email Gateway \u043c\u043e\u0436\u043d\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b Cisco \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Secure Email Gateway \u2014 \u0448\u043b\u044e\u0437\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u043f\u043e\u0447\u0442\u0443 \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439. \u0418\u0440\u043e\u043d\u0438\u0447\u043d\u043e, \u043d\u043e \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u0448\u043b\u044e\u0437\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u0430 \u0435\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 root-\u043f\u0440\u0430\u0432\u0430.\n\nhttps://xakep.ru/2026/09/17/cve-2026-76461/", "url": "https://t.me/xakep_ru/20069", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T00:00:06.312Z", "date_only": false, "value": "2026-09-18T00:00:06.312346Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3154", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "22e8b816-3080-47d7-8617-6c76812d2f54", "content": "\ud83d\udd34 Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation\n\nCisco warned customers on Monday that a zero-day vulnerability affecting Secure Email Gateway appliances has been exploited in the wild.\n\nThe vulnerability is identified as CVE-2026-76461 and has a CVSS score of 9.8. Cisco describes it as an email parsing issue in AsyncOS software that can be exploited remotely and without authentication to execute arbitrary commands on the underlying operating system with root privileges.\n\nThe tech giant explained that the critical flaw can be exploited to execute malicious SQL statements by sending them to the targeted user inside a specially crafted email.", "url": "https://t.me/pphm_HackerNews/3154", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T04:00:04.972Z", "date_only": false, "value": "2026-09-18T04:00:04.972983Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQAQENmCSqqZFt1CgIPFO1DWOGFtHtUbTSYQzyOLtc0lT80", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "470a8e48-104f-4709-b589-c0cc001bc997", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T04:00:05.976Z", "date_only": false, "value": "2026-09-18T04:00:05.976543Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/hRhfHQLITc7psesxFSOQcooUliQKpsQZbLjfTlveUuwzAg", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "6168d39f-74da-4341-885d-493a7a66bb4e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T04:00:12.797Z", "date_only": false, "value": "2026-09-18T04:00:12.797443Z", "kind": "sighting", "label": "Seen", "source": "Telegram/P5aaBxBg5fY1VZGTEsJ6wFdp3qVI9fN_NhMWOCqsSdZd8hc", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d42e1860-f8dc-4f9d-ab62-ca009095d79c"}, {"timestamp": "2026-09-18T04:00:14.677Z", "date_only": false, "value": "2026-09-18T04:00:14.677568Z", "kind": "sighting", "label": "Seen", "source": "Telegram/bBb4QpmY2DLu7TtLTVsd6gE7Q5SjiiWXaQweCyoOeGKXNwE", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "239577eb-df53-468e-97ed-ea50142c6206"}, {"timestamp": "2026-09-18T06:35:06.664Z", "date_only": false, "value": "2026-09-18T06:35:06.664338Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvrkgvh6cb2s", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "9d6c94b4-d1f3-4cc5-8532-a82dc970ff23", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 48 interactions\nCVE-2026-76460: 18 interactions\nCVE-2026-76461: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-58704: 10 interactions\nCVE-2026-76460: 8 interactions\nCVE-2023-28252: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mvrkgvh6cb2s"}, {"timestamp": "2026-09-18T12:10:27.392Z", "date_only": false, "value": "2026-09-18T12:10:27.392Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-76461", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-18T12:10:27.392Z", "date_only": false, "value": "2026-09-18T12:10:27.392Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisco", "record": "CVE-2026-76461", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T12:15:04.440Z", "date_only": false, "value": "2026-09-18T12:15:04.440346Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/09/cert-se-veckobrev-v38.html", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "63bbe7bc-0904-47c2-888c-8c26f678510d", "url": "https://www.cert.se/2026/09/cert-se-veckobrev-v38.html"}, {"timestamp": "2026-09-18T19:26:59Z", "date_only": false, "value": "2026-09-18T19:26:59+00:00", "kind": "other", "label": "Document generated", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-19T00:00:11.825Z", "date_only": false, "value": "2026-09-19T00:00:11.825860Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/bBb4QpmY2DLu7TtLTVsd6gE7Q5SjiiWXaQweCyoOeGKXNwE", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "06cb27ac-2362-4aaa-aa3a-5fa85f187dcd", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-19T00:00:14.092Z", "date_only": false, "value": "2026-09-19T00:00:14.092819Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/P5aaBxBg5fY1VZGTEsJ6wFdp3qVI9fN_NhMWOCqsSdZd8hc", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "34f3e6a7-9acc-4cae-b925-83c43db82966", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-19T09:00:04.966Z", "date_only": false, "value": "2026-09-19T09:00:04.966327Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/HackerNewscyber/3459", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "68d12766-c2ac-40f5-b787-45fa2e8b1fa4", "content": "\u2708 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632\u0635\u0641\u0631 \u0633\u06cc\u0633\u06a9\u0648 \u0628\u0627 \u062f\u0633\u062a\u0631\u0633\u06cc Root\n\n\u00a9\ufe0f \u0634\u0631\u06a9\u062a \u0633\u06cc\u0633\u06a9\u0648 \u0627\u0632 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632\u0635\u0641\u0631 CVE-2026-76461 \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a Secure Email Gateway \u062e\u0628\u0631 \u062f\u0627\u062f.\n\n\u00a9\ufe0f \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0628\u0627 \u0634\u062f\u062a 9.8 \u0627\u0632 10\u060c \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0650 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0627 \u0627\u0631\u0633\u0627\u0644 \u0627\u06cc\u0645\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628\u060c \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u062f\u0633\u062a\u06af\u0627\u0647 \u0628\u0627 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc Root \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0631 \u062f\u0648 \u0646\u0633\u062e\u0647 \u0641\u06cc\u0632\u06cc\u06a9\u06cc \u0648 \u0645\u062c\u0627\u0632\u06cc Secure Email Gateway \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 CISA \u0646\u06cc\u0632 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 (KEV) \u0627\u0636\u0627\u0641\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u00a9\ufe0f \u0633\u06cc\u0633\u06a9\u0648 \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f6 \u0627\u0632 \u0627\u06cc\u0646 \u0646\u0642\u0635 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0648 \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0627\u0644\u0627\u06cc \u062d\u0627\u0635\u0644 \u0627\u0632 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u060c \u0627\u0645\u06a9\u0627\u0646 \u062d\u0630\u0641 \u06cc\u0627 \u0645\u062e\u0641\u06cc\u200c\u0633\u0627\u0632\u06cc \u0628\u0631\u062e\u06cc \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0646\u0641\u0648\u0630 \u0646\u06cc\u0632 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.\n\n\ud83c\udf10 @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3459", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-19T09:00:05.015Z", "date_only": false, "value": "2026-09-19T09:00:05.015780Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/nss9RZ7vjHv-gugT0zVY6KvgjspP6yWwNwAuX8kB_2GfXFHM", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d538a61c-6c2e-4827-98ab-a277438bb9b0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-19T11:35:51.728Z", "date_only": false, "value": "2026-09-19T11:35:51.728035Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hevo.bsky.social/post/3mvulpk2uy22e", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "38ed9eb2-bd0a-4338-8f54-a78b52ac5f41", "content": "\u300c\u653b\u6483\u8005\u304c\u60aa\u610f\u306e\u3042\u308bSQL\u6587\u3092\u542b\u3080\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u3068root\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u300dSecure Email Gateway\u3068\u3044\u3046\u30ae\u30e3\u30b0\u3002\u3059\u3067\u306b\u60aa\u7528\u306f\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u3089\u3057\u3044\u3002\n\nCisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\nwww.jpcert.or.jp/at/2026/at26...", "url": "https://bsky.app/profile/hevo.bsky.social/post/3mvulpk2uy22e"}, {"timestamp": "2026-09-21T09:04:24.276Z", "date_only": false, "value": "2026-09-21T09:04:24.276103Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/kasperskyb2b/2319", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d29accd7-ff99-4bf5-99c8-cfa692098a7b", "content": "\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e \n\n\ud83d\ude80 \u0410\u043d\u0430\u043b\u0438\u0437 \u043d\u043e\u0432\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 APT NightEagle/APT-Q-95, \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u0432\u0448\u0435\u0439 \u0441\u0432\u043e\u044e \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439. \u041a\u0440\u043e\u043c\u0435 \u0410\u0437\u0438\u0438 \u0442\u0435\u043f\u0435\u0440\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0442 \u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u044e\u0442 \u0444\u0438\u0440\u043c\u0435\u043d\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 GhostContainer \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Exchange. \u0414\u043b\u044f \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b rdp2tcp \u0438 MS dev tunnels, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 AD. \n\n\ud83d\udfe2\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 SparroWocky, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e APT FamousSparrow/Salt Typhoon \u0432 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435. \u0412\u041f\u041e \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043a\u0440\u044b\u0442\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0430\u043b\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 Windows, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u043e\u0432 Beacon Object File \u043e\u0442 Cobalt Strike \u0438 \u043a\u043e. \n\n\ud83d\udfe2\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 UNC3569, \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0448\u043f\u0438\u043e\u043d\u044f\u0449\u0430\u044f \u0437\u0430 \u0430\u0437\u0438\u0430\u0442\u0441\u043a\u0438\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c\u0438, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u0430 \u0444\u0438\u0440\u043c\u0435\u043d\u043d\u044b\u0439 Windows-\u0431\u044d\u043a\u0434\u043e\u0440 GRAYRABBIT, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0435\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0432\u0432\u043e\u0434\u0430 (IME) Sogou \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Tencent.\n\n\ud83d\udfe2\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043d\u043e\u0432\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043e\u0442 APT TraderTraitor/Jade Sleet/UNC4899, \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u0437\u0430\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0435 \u0441\u043e\u0431\u0435\u0441\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u043d\u0435 \u0438\u043c\u0435\u044e\u0442 \u043d\u0438\u043a\u0430\u043a\u043e\u0433\u043e \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u044f \u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438 \u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430\u043c\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0418\u0422-\u0443\u0441\u043b\u0443\u0433. \u041f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u0443\u0436\u0435 \u0437\u043d\u0430\u043a\u043e\u043c\u044b\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b \u0434\u043b\u044f Mac: Flatroof/Gaslight, Roofdeck.\n\n\ud83d\udd35\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e BambooToken \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0430\u0437\u0438\u0430\u0442\u0441\u043a\u0438\u0435 \u0438 \u043b\u0430\u0442\u0438\u043d\u043e\u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 2023 \u0433\u043e\u0434\u0430, \u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041e\u043d\u043e \u043f\u043e\u0440\u0430\u0436\u0430\u0435\u0442 Windows- \u0438 Linux-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u04212 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b MQTT. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a \u0412\u041f\u041e \u043d\u0430 Windows \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c DLL sideloading \u0438\u0437 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f OnKey, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\n\n\ud83d\udd35\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0412\u041f\u041e Cyclops Blink, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Cisco FMC. \u041d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0434\u043b\u044f  x86-64 Linux, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438 \u043d\u0430 \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.\n\n\ud83d\udfe3\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043d\u043e\u0432\u043e\u0433\u043e MaaS VectraRAT \u2014 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441\u0442\u0438\u043b\u0435\u0440\u0430 \u0438 \u0442\u0440\u043e\u044f\u043d\u0446\u0430 \u0434\u043b\u044f Windows, \u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0443\u043b\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e 48% \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445. \n\n\ud83d\udfe3\u0422\u0440\u0430\u0444\u0438\u043a \u043a \u043e\u043d\u043b\u0430\u0439\u043d-\u043a\u0430\u0437\u0438\u043d\u043e \u0438 \u043f\u043e\u0440\u043d\u043e\u0441\u0430\u0439\u0442\u0430\u043c \u043c\u043e\u0436\u0435\u0442 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0431\u041e\u043b\u044c\u0448\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0440\u0443\u043f\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441\u043b\u0443\u0436\u0438\u043b\u0438 \u04212 \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0445 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u043e\u0432.\n\n\ud83d\udfe3\u0421\u0435\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 GitHub \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (LastPass \u0438 40 \u0434\u0440\u0443\u0433\u0438\u0445) \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u0435\u0440\u0430 Rapuncel.  \u0418\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0442\u043e\u0440 \u0412\u041f\u041e \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c 140+ \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435.\n\n\ud83d\udd35\u0416\u0435\u043b\u0430\u044e\u0449\u0438\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u00ab\u041e\u0434\u0438\u0441\u0441\u0435\u044e\u00bb \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0431\u043e\u043d\u0443\u0441 \u2014 \u0440\u0430\u0437\u0443\u043c\u0435\u0435\u0442\u0441\u044f, \u044d\u0442\u043e \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \ud83e\udd2a. \u0410 \u0442\u043e\u0447\u043d\u0435\u0435, \u043d\u043e\u0432\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a MovieReaper, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0431\u043b\u043e\u043a\u0447\u0435\u0439\u043d Solana \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u04212. \n\n\ud83d\udd35\u041d\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u043d\u043e \u0443\u0436 \u043e\u0447\u0435\u043d\u044c \u0432\u043e\u0437\u043c\u0443\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f. \u0424\u0438\u043d\u0442\u0435\u0445 Revolut \u043f\u0435\u0440\u0435\u0434\u0430\u043b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e 680 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445. \u041c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u044b\u0434\u0430\u0432\u0430\u043b\u0438 \u0441\u0435\u0431\u044f \u0437\u0430 \u0438\u0442\u0430\u043b\u044c\u044f\u043d\u0441\u043a\u0443\u044e \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u043b\u0443\u0436\u0431\u0443 \u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u043d\u0443\u0436\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 5 \u043c\u0435\u0441\u044f\u0446\u0435\u0432.\n\n\ud83d\udfe3\u041a\u043e\u0440\u043e\u0442\u043a\u043e \u043e Cisco: \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ISE (CVE-2026-76460, CVSS 10) \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Secure Email Gateway (CVE-2026-76461, CVSS 9.8). \ud83d\udd25\n\n#\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 #APT @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2319"}, {"timestamp": "2026-09-30T15:46:10.508Z", "date_only": false, "value": "2026-09-30T15:46:10.508085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwqotdujfw2z", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "d760329b-3d05-4f2c-b77c-9c259fe8e51a", "content": "Critical Cisco zero-days in Email Gateway & Firewall Center under active exploit\u2014patch now! #Cisco #ZeroDay #InfoSec #CVE-2026-76461 #CVE-2026-20079 #FirewallSecurity https://thedailytechfeed.com/cisco-confirms-multiple-zero-days-actively-exploited-in-email-gateway-firewall-tools/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mwqotdujfw2z"}, {"timestamp": "2026-10-04T13:26:54.129Z", "date_only": false, "value": "2026-10-04T13:26:54.129745Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/timb.me.uk/post/3mx2ium2kf2n2", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "37a72771-a77c-46e5-9d73-e036c69dbe3f", "content": "Interesting Git repos of the week:\n\nDetection:\n\n* https://github.com/fevar54/CVE-2026-76461-Detection-Kit- - hunting for Cisco's ESA oopsicle\n* https://github.com/msuiche/hotcell - you can't even trust a document written by Apple these days\n\nBugs:\n\n* https://github.com/pwardle/not-a-mused - [\u2026]", "url": "https://bsky.app/profile/timb.me.uk/post/3mx2ium2kf2n2"}, {"timestamp": "2026-10-14T13:26:28.300Z", "date_only": false, "value": "2026-10-14T13:26:28.300119Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtnkhdx322x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "2a8f1760-87df-483e-8e1a-4ee19ac364ba", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date September 14, 2026\n\nCVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtnkhdx322x"}, {"timestamp": "2026-10-14T13:27:13.891Z", "date_only": false, "value": "2026-10-14T13:27:13.891865Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtnlspams2x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "950dc4a1-23a6-4fc9-b8a3-4248df341288", "content": "\u300cCisco Secure Email Gateway\u300d\u306b\u8106\u5f31\u6027\u3001\u60aa\u7528\u3082 - \u4fb5\u5bb3\u8abf\u67fb\u3092\u547c\u3073\u304b\u3051\n\nCisco Systems\u306f\u73fe\u5730\u6642\u95932026\u5e749\u670814\u65e5\u3001\u300cCisco Secure Email Gateway\u300d\u3092\u5bfe\u8c61\u3068\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u305f\u3002\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3057\u3066\u3044\u308b\u3002\n\n\u540c\u793e\u306b\u3088\u308c\u3070\u3001\u4eca\u56de\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u306e\u306f\u3001\u300cCisco Secure Email Gateway\u300d\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u300cCVE-2026-76461\u300d\u3002\n\n\u30e1\u30fc\u30eb\u89e3\u6790\u51e6\u7406\u306b\u304a\u3051\u308b\u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\u306b\u8d77\u56e0\u3002\u7d30\u5de5\u3055\u308c\u305f\u30e1\u30fc\u30eb\u3092\u51e6\u7406\u3057\u305f\u969b\u3001\u8a8d\u8a3c\u306a\u3057\u306b\u30ea\u30e2\u30fc\u30c8\u3088\u308a\u4efb\u610f\u306eSQL\u3092\u5b9f\u884c...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtnlspams2x"}, {"timestamp": "2026-10-14T13:43:32.893Z", "date_only": false, "value": "2026-10-14T13:43:32.893666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtoixydak2x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "4df3186a-781f-43a6-b99f-4034137ca924", "content": "Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nI. \u6982\u8981\nCisco\u306f\u30012026\u5e749\u670815\u65e5\u306bCisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002\u672c\u8106\u5f31\u6027\u306e\u60aa\u7528\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u60aa\u610f\u306e\u3042\u308bSQL\u6587\u3092\u542b\u3080\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u3001\u8106\u5f31\u6027\u306e\u3042\u308b\u5bfe\u8c61\u30b7\u30b9\u30c6\u30e0\u3067\u30e1\u30fc\u30eb\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001\u5bfe\u8c61\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067root\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002Cisco\u306f\u30012026\u5e749\u6708\u306b\u672c\u8106\u5f31\u6027\u306e...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtoixydak2x"}, {"timestamp": "2026-10-14T13:44:14.784Z", "date_only": false, "value": "2026-10-14T13:44:14.784478Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtok6nxqc2x", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "279b33d2-9171-4b47-9f69-203f08c814b9", "content": "Cisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nI. \u6982\u8981\nCisco\u306f\u30012026\u5e749\u670815\u65e5\u306bCisco Secure Email Gateway\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\uff09\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002\u672c\u8106\u5f31\u6027\u306e\u60aa\u7528\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u60aa\u610f\u306e\u3042\u308bSQL\u6587\u3092\u542b\u3080\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u3001\u8106\u5f31\u6027\u306e\u3042\u308b\u5bfe\u8c61\u30b7\u30b9\u30c6\u30e0\u3067\u30e1\u30fc\u30eb\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001\u5bfe\u8c61\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067root\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002Cisco\u306f\u30012026\u5e749\u6708\u306b\u672c\u8106\u5f31\u6027\u306e...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxtok6nxqc2x"}, {"timestamp": "2026-10-14T19:58:07.853Z", "date_only": false, "value": "2026-10-14T19:58:07.853200Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxudgswkzs2d", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "6138b5f5-349d-4bb0-b9c6-e1503fa9a6aa", "content": "\u7c73\u5f53\u5c40\u3001\u300cCisco Secure Email Gateway\u300d\u306e\u8106\u5f31\u6027\u60aa\u7528\u3092\u8b66\u544a\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u300cCisco Secure Email Gateway\u300d\u306e\u8106\u5f31\u6027\u304c\u5b9f\u969b\u306e\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u305f\u3002\n\n\u73fe\u5730\u6642\u95932026\u5e749\u670814\u65e5\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u300cCVE-2026-76461\u300d\u3092\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8ffd\u52a0\u3057\u305f\u3082\u306e\u3002\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u305b\u305a\u3001\u30ea\u30e2\u30fc\u30c8\u3088\u308a\u653b\u6483\u3092\u53d7\u3051\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u3002\n\n\u300cCisco Secure Email Gateway\u300d\u306f\u3001\u30e1\u30fc\u30eb\u306e\u9001\u53d7\u4fe1\u3092\u4fdd\u8b77\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u88fd\u54c1\u3002...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxudgswkzs2d"}, {"timestamp": "2026-10-14T20:07:18.636Z", "date_only": false, "value": "2026-10-14T20:07:18.636479Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxudx6clkk2d", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "43c1d4e1-f337-4990-94c0-3055e3002695", "content": "\u30b7\u30b9\u30b3\u3001\u91cd\u8981\u306a\u30e1\u30fc\u30eb\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u305f\u653b\u6483\u304c\u7d99\u7d9a\u4e2d\u3067\u3042\u308b\u3068\u8b66\u544a\n\nCisco\u306f\u3001\u30bb\u30ad\u30e5\u30a2\u30e1\u30fc\u30eb\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\uff08CVE-2026-76461\u3001CVSS\u30b9\u30b3\u30a29.8\uff09\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u60aa\u7528\u53ef\u80fd\u3067\u3059\u3002\u653b\u6483\u8005\u306f\u3001\u60aa\u610f\u306e\u3042\u308bSQL\u6587\u3092\u542b\u3080\u7279\u6b8a\u306a\u30e1\u30fc\u30eb\u3092\u7d30\u5de5\u3057\u3066\u9001\u4fe1\u3059\u308b\u3053\u3068\u3067\u3001\u57fa\u76e4\u3068\u306a\u308b\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067root\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002Cisco\u306f\u3001\u3053\u306e\u8106\u5f31\u6027\u304c\u65e2\u306b\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\n\n\u300cCisco Secure Email Gateway\u5411\u3051Cisco Asyn...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxudx6clkk2d"}, {"timestamp": "2026-10-15T13:21:05.079Z", "date_only": false, "value": "2026-10-15T13:21:05.079342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxw5pq3efk2u", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "c85f7d6d-b304-445a-9294-d61ff859a304", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001Cisco Secure Email Gateway\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ea\u30b9\u30c8\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f \u3001Cisco Secure Email Gateway\u306e\u8106\u5f31\u6027\uff08CVE-2026-76461\u3001CVSS\u30b9\u30b3\u30a29.8\uff09\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u30b7\u30b9\u30b3\u306f\u4eca\u9031\u3001\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027CVE-2026-76461\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u60aa\u7528\u53ef\u80fd\u3067\u3059\u3002\u653b\u6483\u8005\u306f\u3001\u60aa\u610f\u306e\u3042\u308bSQL\u6587...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mxw5pq3efk2u"}, {"timestamp": "2026-10-15T16:02:40.681Z", "date_only": false, "value": "2026-10-15T16:02:40.681925Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117445765362861606", "record": "cve-2026-76461", "field": "creation_timestamp", "uuid": "b0136c60-8465-4d6f-9e42-fdb309aa8071", "content": "New advisory.\nArctic Wolf: CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required https://arcticwolf.com/resources/blog/cve-2026-76461-active-exploitation-of-cisco-secure-email-gateway-critical-zero-day-vulnerability-immediate-mitigation-required/\nThere were other vulnerabilities that Cisco addressed yesterday\nCRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm\nCRITICAL: CVE-2026-76519: Cisco Secure Email Gateway Arbitrary File Write Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp #infosec #Cisco #vulnerability", "url": "https://infosec.exchange/users/AAKL/statuses/117445765362861606"}], "metrics": {"as_of": "2026-10-29T19:18:37.687Z", "anchors": {"origin": {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-18T04:00:04.972Z", "date_only": false, "value": "2026-09-18T04:00:04.972983Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQAQENmCSqqZFt1CgIPFO1DWOGFtHtUbTSYQzyOLtc0lT80", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "470a8e48-104f-4709-b589-c0cc001bc997", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": -57600.0, "hours": -16.0, "days": -0.6666666666666666, "min_seconds": -57600.0, "max_seconds": 28800.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": -57600.0, "hours": -16.0, "days": -0.6666666666666666, "min_seconds": -57600.0, "max_seconds": 28800.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 302404.972, "hours": 84.00138111111112, "days": 3.5000575462962966, "min_seconds": 302404.972, "max_seconds": 302404.972, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-18T04:00:04.972Z", "date_only": false, "value": "2026-09-18T04:00:04.972983Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQAQENmCSqqZFt1CgIPFO1DWOGFtHtUbTSYQzyOLtc0lT80", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "470a8e48-104f-4709-b589-c0cc001bc997", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 3899917.68721, "hours": 1083.3104686694444, "days": 45.13793619456019, "min_seconds": 3899917.68721, "max_seconds": 3899917.68721, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-14T16:00:00Z", "date_only": false, "value": "2026-09-14T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-ESA-INJ-2BLVGMHX", "record": "CISCO-SA-ESA-INJ-2BLVGMHX", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T19:18:37.687Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 3957517.68721, "hours": 1099.3104686694444, "days": 45.804602861226854, "min_seconds": 3871117.68721, "max_seconds": 3957517.68721, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-14T00:00:00Z", "date_only": false, "value": "2026-09-14T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-76461", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9ac436c8-102a-4823-ba5c-e8df968c9d63", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-10-29T19:18:37.687Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 3597512.71521, "hours": 999.3090875583333, "days": 41.63787864826389, "min_seconds": 3597512.71521, "max_seconds": 3597512.71521, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-18T04:00:04.972Z", "date_only": false, "value": "2026-09-18T04:00:04.972983Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQAQENmCSqqZFt1CgIPFO1DWOGFtHtUbTSYQzyOLtc0lT80", "record": "CVE-2026-76461", "field": "creation_timestamp", "uuid": "470a8e48-104f-4709-b589-c0cc001bc997", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T19:18:37.687Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}