Cisco Secure Email Gateway Zero-Day | Threat Digest

Top Stories#

• Cisco Secure Email Gateway zero-day exploited in attacks. Cisco urged customers to install software updates for CVE-2026-76461, a critical vulnerability that can allow unauthenticated attackers to execute SQL statements and commands with root privileges. The issue is listed in CISA’s Known Exploited Vulnerabilities catalog with a September 17 remediation deadline. See the Cisco security advisory and CISA’s KEV entry.

• Alleged Black Axe leaders face US cybercrime charges. Five alleged leaders of the Black Axe cybercrime syndicate were extradited to the United States to face wire fraud and money laundering charges, according to BleepingComputer.

• Microsoft confirms an Excel copy-and-paste issue. Microsoft confirmed that the September 2026 KB5002914 update may cause Excel copy-and-paste operations to fail silently for some users.

• Emergency Windows updates address Remote Desktop Services failures. Microsoft released out-of-band updates for failures caused by September security updates. The fixes also address reported Hyper-V and USB audio problems. Administrators should review the applicable Microsoft emergency update coverage before broad deployment.

• Japan’s Digital Agency reports possible exposure of 246,000 records. A VPN flaw may have exposed approximately 246,000 record rows containing government employee information. Organizations using similar VPN architectures should review exposure, authentication logs, and access to sensitive datasets. See the incident report.

• Twitch browser extension reportedly exposed OAuth tokens. The Twitch Enhanced Viewer | JeetBot extension, which had approximately 30,000 installs, reportedly transmitted users’ Twitch OAuth session tokens to a commercial bot service. The reported incident warrants immediate extension inventory and token revocation.

• HBO Max Reddit account used in ClickFix malware campaign. Attackers compromised HBO Max’s official Reddit account and used malicious advertisements to distribute ClickFix instructions targeting Windows and macOS users. Details are available in BleepingComputer’s report.

• Red Heron reportedly exploited Gitea RCE. The group reportedly compromised 13 organizations across six countries by exploiting a Gitea remote-code-execution vulnerability. The reported activity makes internet-facing Gitea instances a priority for review.

Critical Vulnerabilities#

CVE-2026-76461: Cisco Secure Email Gateway

• Severity: CVSS 9.8
• Status: Actively exploited and listed in CISA KEV
• Impact: Unauthenticated attackers can exploit insufficient validation in Cisco AsyncOS email parsing to execute arbitrary SQL statements and commands with root privileges.
• Remediation: Install Cisco software updates. No workaround is available.
• Deadline: CISA lists September 17, 2026, as the remediation deadline.

Treat exposed appliances as potentially compromised until investigation is complete. Patch first where operationally safe, preserve relevant evidence, and validate the running AsyncOS version after remediation.

References: Cisco advisory, CVE-2026-76461 in CISA KEV.

CVE-2026-90937: Froxlor

• Severity: CVSS 9.9
• Impact: Authenticated customers can inject web-server configuration directives through newline characters in subdomain redirect URLs.
• Remediation: Upgrade to Froxlor 2.2.5 or later.

See the Froxlor security advisory and additional technical analysis.

CVE-2026-82232: Apache Syncope

• Severity: CVSS 9.8
• Impact: An administrator with sufficient entitlements can achieve arbitrary SQL execution through unsanitized sort clauses in Task search.
• Remediation: Upgrade to Apache Syncope 4.0.8 or 4.1.3.

Review the Apache Syncope security information and the project disclosure.

CVE-2026-90919: ModelTC LightLLM

• Severity: CVSS 9.8
• Impact: An unauthenticated attacker can achieve remote code execution through unsafe pickle deserialization at the Config Server’s /visual_register WebSocket endpoint.
• Remediation: Upgrade to a release containing the fix. Restrict Config Server access until the update is verified.

References include the LightLLM issue, source repository, and technical advisory.

CVE-2026-90898: Maxim HQ Bifrost

• Severity: CVSS 9.8
• Impact: When authentication is disabled, an unauthenticated request to /api/mcp/client can register a stdio MCP client and execute an arbitrary program as the Bifrost process user.
• Remediation: Upgrade transports to version 2.1.0 or later and enable authentication.

Review the Bifrost release, fix commit, and pull request.

What Defenders Should Do Today#

1. Remediate Cisco appliances immediately

Prioritize every internet-facing Cisco Secure Email Gateway appliance affected by CVE-2026-76461.

• Confirm the deployed AsyncOS version against Cisco’s advisory.
• Install the vendor-provided update.
• Record the appliance, version, maintenance time, and validation result.
• Treat unexpected administrative activity or command execution as a possible compromise.
• Preserve logs and configuration state before rebuilding or restoring an affected appliance.
• Complete remediation before the CISA September 17 deadline.

Do not rely on perimeter placement as a mitigation. The vulnerability is described as exploitable by an unauthenticated remote attacker.

2. Hunt for Cisco exploitation indicators

Review appliance telemetry for:

• Unexpected administrative logins or configuration changes
• SQL-related errors or unusual parsing failures
• Commands or processes that administrators did not initiate
• New accounts, altered access policies, or modified mail-routing settings
• Unexpected outbound connections
• Changes to logging, update, or authentication configuration
• Repeated requests to email-processing interfaces from unusual sources

Correlate appliance events with firewall, DNS, proxy, identity, and endpoint telemetry. If compromise is suspected, isolate the system according to business-continuity procedures and preserve evidence before remediation.

3. Patch the remaining critical vulnerabilities

Apply the following fixes based on asset inventory and exposure:

• Froxlor: Upgrade to 2.2.5 or later.
• Apache Syncope: Upgrade to 4.0.8 or 4.1.3.
• LightLLM: Upgrade to a fixed release and restrict Config Server access until patched.
• Bifrost: Upgrade transports to 2.1.0 or later and enable authentication.

For LightLLM and Bifrost, do not expose administrative or configuration interfaces directly to the internet. Use network controls, identity enforcement, and service-level authentication as defense in depth.

4. Review Gitea exposure and compromise indicators

Inventory all Gitea installations, including self-hosted instances that may not appear in central asset-management systems.

Check for:

• Unexpected new users, SSH keys, tokens, or administrators
• Repository changes that do not match approved activity
• Web shells, modified hooks, or suspicious actions
• New processes launched by the Gitea service account
• Unusual outbound traffic from Gitea hosts
• Authentication attempts from unfamiliar locations
• Configuration changes affecting federation, runners, or integrations

Preserve repositories, application logs, process data, and host telemetry before deleting suspicious artifacts.

5. Stage Microsoft updates and communicate known issues

Test September Windows updates in deployment rings rather than applying them indiscriminately to critical systems.

• Deploy Microsoft’s emergency fixes where Remote Desktop Services failures affect operations.
• Test Hyper-V and USB audio functionality in representative environments.
• Inform Excel users that KB5002914 may cause copy-and-paste operations to fail silently.
• Monitor help-desk tickets for new RDS, Excel, Hyper-V, and USB-related symptoms.
• Document any rollback or deferred-update decision and define a re-evaluation date.

6. Remove the affected Twitch extension and revoke tokens

Use browser-management tools and endpoint inventory to identify the Twitch Enhanced Viewer | JeetBot extension.

For affected users:

1. Remove the extension from managed and unmanaged browsers.
2. Revoke Twitch OAuth session tokens and connected application access.
3. Review account sessions and recent account activity.
4. Reset credentials if suspicious activity is present.
5. Investigate whether the same browser profile contained sensitive enterprise sessions.

Token revocation is essential because removing the extension alone may not invalidate tokens that were already transmitted. For personal accounts, use a reputable password manager such as 1Password to create unique credentials.

7. Block ClickFix-style behavior

Warn users that legitimate support instructions should not require them to paste commands into PowerShell, Command Prompt, Terminal, or browser developer tools.

Detection priorities include:

• Browsers spawning PowerShell, shell, or Terminal processes
• Suspicious clipboard use followed by command execution
• Office or browser processes launching script interpreters
• Encoded or obfuscated command lines
• Downloads initiated after visiting compromised social-media pages
• New persistence mechanisms shortly after a user followed troubleshooting instructions

Review endpoint prevention controls and ensure users can report suspicious advertisements and social-media links quickly.

8. Assess VPN exposure and sensitive-record access

Organizations operating VPN infrastructure should review:

• Internet-facing VPN versions and security advisories
• Authentication and administrative access logs
• Unusual access to employee or personnel databases
• Bulk queries, exports, or unusual record enumeration
• New accounts, changed privileges, and token activity
• Connections from unexpected geographic or network locations

Rotate credentials, session tokens, and keys where exposure is plausible. Confirm whether sensitive records were accessed or exfiltrated, and preserve evidence for incident response and notification decisions.

9. Increase monitoring for perimeter and administrative systems

Prioritize detection of:

• Newly created privileged accounts
• Unexpected configuration changes
• Unusual remote-management activity
• Administrative access outside approved maintenance windows
• New outbound connections from appliances and management servers
• Service processes spawning shells or interpreters
• Authentication anomalies across VPN, email, code-hosting, and administration platforms

Review privileged access management (PAM) controls to confirm that administrative access is limited, monitored, and reviewed.

Technical Notes#

Verify Cisco appliance inventory and update state

Use the organization’s approved administrative interface or management tooling to verify appliance versions. For a shell-based inventory workflow, adapt the following pattern to the local environment and avoid collecting secrets:

# Example: inventory systems from an approved management host
printf 'asset,management_address,reported_version\n' > cisco-email-inventory.csv

# Query the organization's CMDB, API, or approved management tool.
# Do not place credentials directly in shell history or scripts.

After updating, record:

Asset:
Previous version:
Updated version:
Update time:
Validation performed:
Evidence location:
Owner:

Search centralized logs for suspicious activity

Field names vary by platform. Start with a narrow time window around the earliest suspicious event, then expand as needed.

(source="email_gateway" OR device_type="secure_email_gateway")
AND (
  message contains "SQL"
  OR message contains "command"
  OR message contains "parse"
  OR message contains "configuration"
  OR action in ("admin_login", "config_change", "process_start")
)

Correlate results with:

(source="firewall" OR source="proxy" OR source="dns")
AND destination_asset="affected-email-gateway"
AND timestamp within 24h

Do not treat the absence of a matching string as proof that exploitation did not occur. Validate logging coverage, retention, and clock synchronization.

Hunt for suspicious Gitea changes

On an authorized Gitea host, review service activity and recent file changes using local incident-response procedures:

# Identify the service and recent process activity
ps auxww | grep -i '[g]itea'
systemctl status gitea --no-pager

# Review recent service logs where systemd is used
journalctl -u gitea --since "2026-09-14" --no-pager

# Review recently changed files in approved application and repository paths
find /path/to/gitea -type f -mtime -3 -printf '%TY-%Tm-%Td %TH:%TM %p\n' \
  2>/dev/null | sort

Replace paths with the documented installation locations. Preserve evidence before deleting unauthorized files or resetting repositories.

Detect browser-to-shell execution patterns

Example endpoint query logic can identify a common ClickFix signal:

parent_process_name in ("chrome.exe", "msedge.exe", "firefox.exe", "Safari")
and child_process_name in (
  "powershell.exe",
  "pwsh.exe",
  "cmd.exe",
  "wscript.exe",
  "cscript.exe",
  "bash",
  "zsh",
  "osascript"
)

Tune the query for legitimate administrative workflows and investigate the command line, user, URL history, clipboard-related telemetry, and subsequent persistence activity.

Validate OAuth token response

For affected Twitch accounts, document token invalidation and session review:

User:
Extension removed:
OAuth applications reviewed:
Tokens or sessions revoked:
Password reset required:
Suspicious activity found:
Investigation ticket:

Retain the record with the incident or identity-management case so revocation can be verified after remediation.

Bottom Line#

CVE-2026-76461 is the highest-priority issue in today’s digest because it is actively exploited, affects a security perimeter appliance, and can provide root-level command execution without authentication. Patch Cisco Secure Email Gateway systems immediately, investigate exposed appliances for compromise, and complete remediation before CISA’s September 17 deadline.

In parallel, patch the remaining critical vulnerabilities, restrict AI and management interfaces, audit Gitea deployments, address Microsoft update side effects, revoke exposed OAuth tokens, and reinforce defenses against ClickFix social engineering.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.