Search: “secure-email-gateway”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Cisco Secure Email Gateway Vulnerability Exploited in Attacks (CVE-2026-76461)

Cisco Secure Email Gateway flaw CVE-2026-76461 enables root command execution via crafted email SQL injection and is actively exploited, added to CISA KEV.

Cisco disclosed critical vulnerability CVE-2026-76461 in Secure Email Gateway, caused by insufficient validation in email parsing logic, allowing arbitrary SQL statements that lead to root-level command execution. CISA added the flaw to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 17, 2026. The bug affects all SEG deployments regardless of configuration, with fixed releases including 15.5.5-014, 16.0.4-302, and 16.5.0-780. Defenders can check mail_logs for anomalous 'COPY ... TO PROGRAM' SQL statements to detect compromise.

Qualys ThreatPROTECT·updated Sep 16, 13:57 UTC · 21h ago·first Sep 15, 13:37 UTC · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

82

New Phishing Attacks Use Trusted Email Infrastructure and URL Cloaking to Bypass Security Tools

Virus Bulletin Q3 2026 report details phishing using DKIM-aligned senders, Amazon SES delivery, and real-time URL cloaking to evade email security and scanners.

Virus Bulletin's Q3 2026 testing found phishing campaigns delivered through trusted infrastructure like Amazon SES with DKIM-aligned sender domains. Samples included a German overdue-invoice lure redirecting to OpenSea crypto fraud and a Romanian BCR-branded PSD2 banking credential-theft campaign. Cloaking pages used hidden iframes, browser fingerprinting, and time-zone checks to show different content to scanners versus victims. Defenders are urged to inspect full redirect chains rather than attachments or initial URLs alone.

Cyber Security News·updated Sep 15, 13:04 UTC · 1d ago·first Sep 15, 12:02 UTC · 1d agoPhishing & fraud in the wild 2 sources

45

Cisco Secure Email Gateway SQL Injection Vulnerability

Unauthenticated SQL injection in Cisco Secure Email Gateway email parsing enables root command execution via crafted messages; patches released.

A vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Insufficient validation in the email parsing logic lets a crafted email containing malicious SQL statements achieve arbitrary SQL execution and root command execution. Cisco has released software updates, and the companion September 2026 hardening advisory states this flaw is actively exploited.

Cisco Security Advisories·Sep 14, 16:00 UTC · 2d agoVulnerability in the wild

82

Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026

Cisco's September 2026 hardening release for Secure Email Gateway and Secure Email and Web Manager patches internally found flaws, one actively exploited.

Cisco issued a security hardening release for Cisco Secure Email Gateway and Secure Email and Web Manager covering multiple internally discovered vulnerabilities, grouped by CWE class to streamline patching. Cisco states one of the vulnerabilities is known to be actively exploited. The exploited issue is the Cisco Secure Email Gateway SQL Injection Vulnerability detailed in a companion advisory. Software updates are available.

Cisco Security Advisories·Sep 14, 16:00 UTC · 2d agoAdvisory in the wild6

72

Cisco patches Secure Email Gateway zero-day exploited in attacks

Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76461 enabling unauthenticated root command execution; CISA adds it to KEV.

Cisco disclosed that a critical zero-day (CVE-2026-76461) in the email parsing logic of AsyncOS for Secure Email Gateway is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL statements that lead to root-level command execution on virtual and physical appliances. CISA added the flaw to its KEV catalog and ordered federal agencies to patch within three days, by September 17. Cisco also patched four other critical SEG/SEWM vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) with no evidence of exploitation, and shared IOCs including suspicious SQL statements in mail_logs.

BleepingComputer·Sep 15, 07:31 UTC · 2d agoExploit / PoC in the wildCVE-2026-76461CVE-2026-76440CVE-2026-76441+3 CVEs

90

Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities

Cisco released an advisory for S/MIME ciphertext decryption flaws in Secure Email that could let unauthenticated remote attackers recover plaintext via machine-in-the-middle.

Multiple vulnerabilities in the S/MIME decryption functionality of Cisco Secure Email stem from insufficient validation of message integrity. An unauthenticated remote attacker could intercept and modify traffic between email gateways using a machine-in-the-middle technique to obtain plaintext from encrypted messages. No workarounds are available; no CVE identifiers or exploitation status were included in the advisory text.

Cisco Security Advisories·Sep 8, 11:22 UTC · 9d agoAdvisory

25

Dell Secure Connect Gateway Vulnerabilities Allow Hackers to Gain Unauthorized Access

Dell patches three critical flaws (CVSS up to 9.8) in Secure Connect Gateway 5.0 enabling admin token replay, unauthenticated RCE, and root escalation.

Dell disclosed three critical vulnerabilities in Secure Connect Gateway 5.0 appliance and application deployments. CVE-2026-80172 (CVSS 9.8) lets unauthenticated attackers replay captured requests, which lack nonce validation and time limits, to repeatedly mint administrator access and refresh tokens. CVE-2026-61410 (9.4) is a missing-authorization flaw enabling unauthenticated remote command execution, and CVE-2026-80238 (9.3) is an exposed Docker socket allowing local privilege escalation to root and container escape. Fixes ship in appliance 5.36.00.16 and application 5.36.00.00.

Cyber Security News·Sep 8, 15:22 UTC · 8d agoVulnerabilityCVE-2026-80172CVE-2026-61410CVE-2026-80238

68

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.

cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.

The Hacker News·Sep 9, 08:19 UTC · 8d agoVulnerabilityCVE-2026-67401

56

cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root

cPanel disclosed CVE-2026-67401, an authenticated SQL injection in EmailTrack that lets attackers write files and execute code as root.

cPanel disclosed CVE-2026-67401 on September 8, 2026: a SQL injection in the EmailTrack feature that allows authenticated account holders with mail-related permissions to create arbitrary files and execute code with root privileges. Fixes shipped in v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and WP2 channel v11.138.1.9, with all supported versions before those releases affected. Root-level execution poses severe risk to shared hosting providers and multi-tenant servers, as it removes isolation between cPanel accounts, websites, mailboxes, and backups. Researchers Ali Mustafa (rz1027) and abed1526 responsibly reported the flaw.

GBHackers·Sep 9, 07:27 UTC · 8d agoVulnerabilityCVE-2026-67401

52

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security·Sep 10, 15:14 UTC · 6d agoPhishing & fraud

25

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability

Cisco expanded an SSL VPN denial-of-service advisory to cover all ASA and FTD software platforms; unauthenticated attackers can exhaust device memory.

A vulnerability in the VPN and management web servers of Cisco ASA Software and Cisco Secure FTD Software allows an unauthenticated remote attacker to exhaust system memory or buffer blocks, causing a denial of service. Originally scoped to the ASAv and FTDv virtual appliances, Cisco updated the advisory on September 16, 2026 to cover all ASA and FTD platforms.

Cisco Security Advisories·Sep 16, 16:05 UTC · 19h agoAdvisory 9 sources

45

Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft

Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.

An internet scan of 3,074 exposed LiteLLM instances found 294 (9.6%) accepting the default sk-1234 master key and 191 (6.2%) requiring no authentication. CVE-2026-59822 lets a single-character Bearer token establish a valid MCP session via an OAuth2 fallback in versions before 1.84.0; the flaw is in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-59821 allows Python code execution as root in the gateway container via unsanitized Custom Code Guardrails registration before 1.82.0-stable, and CVE-2026-35029 permits config changes leading to RCE and admin takeover. Admin access plus pass-through endpoints can reach cloud metadata services to steal IAM credentials.

GBHackers·Sep 10, 12:56 UTC · 6d agoAI safety & security in the wild 2 sourcesCVE-2026-59822CVE-2026-59821CVE-2026-35029

74

ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.

Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.

CSO Online·Sep 9, 11:48 UTC · 8d agoAI safety & security

66

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackers·Sep 8, 12:04 UTC · 8d agoVulnerabilityCVE-2026-80172CVE-2026-61410CVE-2026-80238

55