decrypted · 15 september 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

A crafted email is all it takes to root Cisco's mail gateway

Cisco has confirmed that attackers are actively exploiting a critical flaw in its Secure Email Gateway appliance, and the fix is a mandatory upgrade with no interim workaround. CVE-2026-76461 scores 9.8 out of 10 and needs nothing from the victim beyond having a mail address the gateway handles. CISA added it to its known-exploited list on Monday and gave US federal agencies until Wednesday to patch. Cisco says it doesn't yet know who is behind the attacks.

A letter that runs itself

The flaw sits in how Secure Email Gateway parses incoming messages. Insufficient validation means an attacker can write SQL statements into the content of an ordinary email, and the appliance will execute them as part of a database query, ending in arbitrary command execution as root on the underlying operating system. No credentials, no session, no click from anyone. Sending mail to an address the gateway handles is sufficient.

The useful analogy is a postroom that doesn't just deliver letters but reads instructions written inside them and acts on the spot: opens the safe, photocopies the contents, hands over the master key, all before anyone checks who sent the envelope. That's what's happening here, at the level of a device that sits directly in the path of every email an organisation receives.

The Secure by Design lesson

This is a textbook injection failure, the same family of bug that's been on OWASP's list for two decades: content that arrives from outside the organisation gets treated as trusted input to a database query, rather than as data to be validated and escaped. Secure by Design exists precisely to catch this class of error before shipping, through parameterised queries and strict input handling on anything that touches attacker-controlled content. A mail gateway parsing untrusted email is about as attacker-controlled as input gets.

For UK organisations running Secure Email Gateway, physical or virtual, there is no workaround: the only fix is upgrading to 15.5.5-0141, 16.0.4-3021 or 16.5.0-780 depending on your branch. Cisco's own guidance is to check mail logs for suspicious SQL syntax in the interim. Given the device's position at the perimeter, treat this as a same-week patch, not a maintenance-window one.

Also this week

The NCSC's shadow AI warning is still worth acting on. Earlier this month the NCSC flagged that employees quietly feeding company and customer data into AI tools their employer never approved is now a mainstream risk, citing Microsoft research that 71% of UK employees have used AI tools without sign-off. The agency's advice is not a ban but a design fix: give staff an approved alternative, and apply the same least-privilege, just-in-time access controls to AI agents as to any other non-human identity, since an agent compromised through a vulnerability inherits whatever privileges it was legitimately given. That's a Secure by Design point as much as a policy one: the failure mode isn't the AI tool itself, it's handing it standing access nobody scoped.

The National Cyber Force has a new commander. GCHQ confirmed this week that Air Vice-Marshal Tim Neal-Hopes has completed his tenure leading Britain's offensive cyber unit and handed over to a successor whose identity hasn't yet been formally avowed. It's the NCF's third change of leadership since the unit was set up in 2020 to unify military and intelligence cyber operations, and comes as its permanent home at Samlesbury in Lancashire continues construction with funding committed through 2030. Not a breach story, but a reminder that the UK's offensive capability is a standing institution now, not a wartime improvisation.

Sources

If any of this touches systems you run, get in touch.

A crafted email is all it takes to root Cisco's mail gateway

A letter that runs itself

The Secure by Design lesson

Also this week

Sources

More like this