Two actively exploited zero-days demand immediate action today. CVE-2026-76461 gives unauthenticated attackers root-level command execution on Cisco Secure Email Gateway appliances - no credentials, no user interaction. CVE-2026-85706, a CVSS 10 path traversal in GitLab CE/EE, hit the CISA KEV catalog with a federal patch deadline of today. Meanwhile, Revolut’s disclosure of customer passports to fraudsters who abused a compromised government email account is a stark reminder that the most dangerous attacks often require no technical vulnerability at all.

In the News

Cisco Secure Email Gateway Zero-Day Exploited for Root RCE

CVE-2026-76461 (CVSS 9.8) is an unauthenticated remote code execution vulnerability in Cisco Secure Email Gateway appliances running AsyncOS. The flaw exists in the email parsing engine - insufficient input validation allows a crafted email to trigger arbitrary command execution with root privileges. No authentication is required. No user interaction is needed.

Active exploitation is confirmed. Cisco has released an emergency patch for affected AsyncOS versions. The attack surface is significant: every internet-facing Secure Email Gateway appliance that processes inbound mail is reachable by any sender on the internet. The parsing engine processes the malicious payload before any policy evaluation occurs, meaning content filtering and anti-spam rules do not prevent exploitation.

Organizations running on-premises Cisco Secure Email Gateway should apply the emergency AsyncOS update immediately. For environments where immediate patching is not feasible, the compensating control is to place the appliance behind a mail transfer agent that performs its own parsing validation upstream, though this is an imperfect mitigation. Post-patch, review appliance logs for indicators of prior exploitation - unexpected process spawning, outbound connections from the appliance to non-Cisco update infrastructure, or new local accounts.

MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter)

What defenders should do: Patch AsyncOS immediately. Audit Secure Email Gateway appliance logs for signs of compromise. Evaluate architectural migration to cloud-delivered email security to eliminate appliance-level parsing as an attack surface.

Source: BleepingComputer

CISA Orders Patch for GitLab CVSS 10 Path Traversal - Deadline Today

CVE-2026-85706 is a maximum-severity path traversal vulnerability in GitLab Community Edition and Enterprise Edition. An unauthenticated attacker can read arbitrary files on the GitLab server, including CI/CD pipeline configuration files that contain secrets: API tokens, cloud provider credentials, container registry keys, and code-signing certificates.

CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Federal agencies are ordered to remediate by end of day September 15, 2026. The exploitation path is straightforward - no authentication, no complex chaining - which explains the CVSS 10 score and the speed of weaponization.

The blast radius extends beyond the GitLab server itself. Exposed CI/CD secrets enable attackers to pivot into cloud infrastructure, tamper with build pipelines, and inject malicious code into software artifacts. Organizations using self-hosted GitLab for CI/CD should patch immediately, then rotate every secret that has ever been stored in or passed through the GitLab instance. Assume compromise of any credential the server could access.

MITRE ATT&CK: T1083 (File and Directory Discovery), T1552.001 (Unsecured Credentials: Credentials In Files), T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain)

What defenders should do: Patch GitLab CE/EE immediately. Rotate all CI/CD pipeline secrets, tokens, and credentials. Audit pipeline runner network segmentation - runners should not have direct access to production infrastructure.

Source: BleepingComputer

Revolut Disclosed Customer Passports to Fraudsters via Fake Government Request

Attackers compromised a legitimate government email account and used it to send an emergency data request (EDR) to Revolut, the UK-based fintech platform. The request asked for customer financial records and identity documents. Revolut complied, disclosing passport images and banking data to the attackers.

This attack required no malware, no phishing link, and no technical vulnerability in Revolut’s systems. The email came from a real government domain, meaning SPF, DKIM, and DMARC all passed. The social engineering targeted the process, not the technology. Emergency data requests are designed to bypass standard legal review timelines - they create urgency that short-circuits verification.

EDR abuse has become a recognized attack vector. The FBI and CISA have previously warned about threat actors using compromised government email accounts to submit fraudulent data requests to technology and financial companies. The defense is procedural: out-of-band verification via a known contact at the requesting agency, callback to a published government phone number, and mandatory escalation to legal counsel before any emergency disclosure. Technology controls - step-up authentication before data export, DLP policies on PII disclosure - add enforcement to what must ultimately be a human decision.

MITRE ATT&CK: T1598.003 (Phishing for Information: Spearphishing Service), T1586.002 (Compromise Accounts: Email Accounts)

What defenders should do: Implement out-of-band verification for all emergency data requests - callback to a published agency number, not the number in the email. Require legal counsel approval before emergency PII disclosure. Apply DLP controls and step-up authentication to data export workflows.

Source: The Record (Recorded Future)

China APT UTA0560 Chains Chrome and Windows Zero-Days for GRIMWEDGE Backdoor

Chinese threat cluster UTA0560 executed a spear-phishing campaign around September 1, 2026, targeting non-governmental organizations. The attack chained recently patched vulnerabilities in Chrome and Windows to deliver GRIMWEDGE, a JavaScript-based backdoor, through a single malicious link.

The notable element is speed. The Chrome and Windows patches had been available for only a short period before UTA0560 weaponized the underlying vulnerabilities. This pattern - state-sponsored groups reverse-engineering patches to build exploits - continues to compress the window between patch release and active exploitation. Organizations patching browsers and operating systems on a monthly cycle were exposed.

MITRE ATT&CK: T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution), T1059.007 (Command and Scripting Interpreter: JavaScript)

What defenders should do: Accelerate browser and OS patch deployment to within 48 hours of release for internet-facing endpoints. Deploy browser isolation for high-risk user populations. Monitor for JavaScript-based persistence mechanisms and anomalous browser child processes.

Source: The Hacker News

Defender Action Items

  • CVE-2026-76461 (Cisco Secure Email Gateway): Apply the emergency AsyncOS patch today. Audit appliance logs for unexpected root-level process execution. Evaluate cloud-delivered email security to reduce appliance attack surface.
  • CVE-2026-85706 (GitLab CE/EE): Patch self-hosted GitLab immediately. Rotate every CI/CD secret, token, and credential stored on or accessible to the GitLab server. Verify pipeline runner segmentation from production.
  • Emergency data request (EDR) abuse: Review your organization’s EDR response procedures. Implement mandatory out-of-band verification via published agency phone numbers. Require legal counsel sign-off before emergency PII disclosure.
  • Browser and OS patch velocity: Reduce patch deployment window for Chrome and Windows to 48 hours on internet-facing endpoints. Deploy browser isolation for NGO, policy, and executive user populations targeted by Chinese APT clusters.
  • Sandworm infrastructure targeting: Audit Cisco network device firmware versions against Sandworm’s known exploit chains. Verify integrity of router and firewall configurations. Monitor for Cyclops Blink indicators on edge infrastructure.

Detection Queries

The following Splunk SPL query identifies anomalous process execution on Cisco Secure Email Gateway appliances, targeting the root-level command execution pattern associated with CVE-2026-76461. Tune the appliance_hosts macro to your environment.

index=email_gateway sourcetype=cisco:asyncos:syslog
  (process_name!=mailrd AND process_name!=scannerqd AND process_name!=reportd AND process_name!=updater)
  user=root
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(process_name) as suspicious_processes by host
| where count > 0
| eval alert_msg="Unexpected root process on Secure Email Gateway - investigate for CVE-2026-76461 exploitation"
| table host, first_seen, last_seen, suspicious_processes, count, alert_msg

This query filters out known legitimate AsyncOS daemon processes and surfaces any unexpected root-level execution. False positives may include legitimate firmware updates or manual admin sessions - correlate with change management records. In environments forwarding AsyncOS syslogs to Splunk, this provides a high-fidelity starting point for post-patch compromise assessment.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.