A malformed email hits the gateway and the attacker is root. That is the operational reality of CVE-2026-76461 - a critical zero-day in Cisco Secure Email Gateway that Cisco confirmed is actively exploited as of today. Alongside it, CISA added a ConnectWise ScreenConnect RCE to the Known Exploited Vulnerabilities catalog, and a China-linked APT burned two zero-day chains to backdoor NGOs. Three actively exploited stories, all requiring action today.

In the News

Cisco Secure Email Gateway Zero-Day Exploited for Root RCE

CVE-2026-76461 is a CVSS 9.8 unauthenticated remote code execution vulnerability in Cisco Secure Email Gateway running AsyncOS. The attack vector is the email processing pipeline itself - an attacker sends a malformed email to the gateway, and the parsing logic triggers root-level command execution. No credentials required. No user interaction. The malicious email never needs to reach an inbox; the gateway processes it and the attacker owns the box.

Cisco published an emergency advisory confirming active exploitation and shipping patches today. The attack surface is significant: Secure Email Gateway is deployed on-premises at enterprises and service providers worldwide, sitting directly in the mail flow path - internet-facing by design.

The MITRE ATT&CK mapping here is straightforward: T1190 (Exploit Public-Facing Application) for initial access, followed by T1059 (Command and Scripting Interpreter) for execution at root privilege. Any organization running Secure Email Gateway should treat this as a zero-delay patching event. If patching cannot happen within hours, the compensating control is to place additional network segmentation around the gateway hosts and deploy endpoint detection on those systems to catch post-exploitation activity.

What defenders should do: Apply the emergency AsyncOS patch immediately. If delay is unavoidable, isolate gateway hosts at the network layer and ensure EDR agents are running on mail infrastructure. Audit gateway logs for anomalous outbound connections or unexpected process execution since September 1.

ConnectWise ScreenConnect RCE Added to CISA KEV

CISA added a critical ConnectWise ScreenConnect RCE to the Known Exploited Vulnerabilities catalog today. The KEV addition means federal incident responders are already encountering this exploit in real engagements - this is not theoretical.

Remote monitoring and management tools like ScreenConnect are premium initial access targets for ransomware operators. A single compromised ScreenConnect instance at an MSP gives an attacker authenticated, trusted access to every managed endpoint downstream. The February 2024 ScreenConnect mass exploitation (CVE-2024-1709) demonstrated this supply chain dynamic clearly, and the pattern is repeating.

What defenders should do: MSPs and IT service providers should patch ScreenConnect immediately and enforce phishing-resistant MFA on all remote access surfaces. Restrict ScreenConnect network access to known management hosts only. Deploy EDR on all managed endpoints to detect post-exploitation if the RMM layer is compromised.

China APT Chains Chrome and Windows Zero-Days for NGO Targeting

A China-linked threat actor tracked as UTA0560 chained two zero-day vulnerabilities - one in Google Chrome and one in Microsoft Windows - in targeted spear-phishing campaigns against non-governmental organizations beginning September 1, 2026. The payload is a previously undocumented backdoor that researchers have named GRIMWEDGE.

Both zero-days are now patched, but the operational significance is in the expenditure: zero-day chains are expensive to develop and burning them means the target justified the cost. This is surgical, state-sponsored espionage targeting policy and advocacy organizations - not opportunistic cybercrime. The MITRE ATT&CK chain maps to T1566.002 (Spearphishing Link) for delivery, T1203 (Exploitation for Client Execution) for the Chrome zero-day, T1068 (Exploitation for Privilege Escalation) for the Windows zero-day, and T1547 (Boot or Logon Autostart Execution) for GRIMWEDGE persistence.

What defenders should do: Organizations in policy, advocacy, and international affairs sectors should ensure Chrome and Windows are patched to current versions. Deploy browser isolation to break exploit delivery chains before they reach the rendering engine. Monitor endpoints for unknown persistence mechanisms and unexpected outbound connections.

WSO2 API Manager JWT Bypass Under Active Exploitation

CVE-2026-5430 is a CVSS 9.8 JWT signature bypass in WSO2 API Manager that allows attackers to forge administrator tokens without possessing valid credentials. Both watchTowr and SecurityWeek report active exploitation targeting enterprises with significant API infrastructure.

When JWT signature validation is broken, every authentication decision the API gateway makes is untrustworthy. Attackers mint admin-level tokens, bypass authorization entirely, and access backend services with full privileges. This is T1550.001 (Use Alternate Authentication Material: Application Access Token) in practice.

What defenders should do: Patch WSO2 API Manager immediately. Audit API access logs for admin token usage from unexpected source IPs or at unusual times. Rotate all API secrets and JWT signing keys after patching. If WSO2 cannot be patched immediately, place a web application firewall with JWT validation in front of the API management layer.

Today’s Deep Dive - RMM Tools as Ransomware Initial Access Vectors

The ScreenConnect KEV addition today is not an isolated event - it is the continuation of a pattern that has defined ransomware initial access since 2023. Remote monitoring and management platforms occupy a unique position in enterprise architecture: they are internet-facing by design, they hold administrative credentials for every managed endpoint, and their traffic is inherently trusted by downstream networks.

When a threat actor compromises an RMM instance, they inherit the trust relationship between the MSP and every customer. This is not lateral movement in the traditional sense - it is legitimate, authenticated access through a trusted management channel. The Kaseya VSA incident in July 2021 demonstrated this at scale when REvil pushed ransomware to approximately 1,500 organizations through a single supply chain compromise. The February 2024 ScreenConnect exploitation (CVE-2024-1709, CVSS 10.0) repeated the pattern.

The MITRE ATT&CK technique is T1133 (External Remote Services) for the initial access, often followed by T1072 (Software Deployment Tools) when the attacker uses the RMM platform itself to distribute payloads. Detection is difficult precisely because the activity looks like normal management operations.

The primary mitigations are layered: enforce phishing-resistant MFA on all RMM administrative access (T1078 defense), restrict RMM network traffic to known management IP ranges at the firewall (T1133 defense), deploy EDR independently of the RMM platform on every managed endpoint (so compromise of one does not blind the other), and maintain offline backups that the RMM platform cannot reach. A compromised RMM tool that can also delete backups is the complete ransomware kill chain in a single platform.

Detection Spotlight

For organizations running ScreenConnect, this Splunk SPL query identifies anomalous session creation patterns that may indicate exploitation - specifically, new sessions originating from IP addresses not in your known management range, created outside normal business hours.

index=screenconnect sourcetype="screenconnect:sessions"
  EventType="SessionCreated"
  | eval hour=strftime(_time, "%H")
  | where hour < 6 OR hour > 22
  | stats count by SessionID, RemoteIP, MachineName, _time
  | lookup known_mgmt_ips.csv ip AS RemoteIP OUTPUT is_known
  | where isnull(is_known) OR is_known!="true"
  | sort -_time

This query requires a lookup table (known_mgmt_ips.csv) containing your legitimate management source IPs. False positive rate depends on the accuracy of that lookup - expect tuning in the first 48 hours. Any hit after today’s KEV addition warrants immediate investigation.

Defender Action Items

  • Cisco Secure Email Gateway: Apply emergency AsyncOS patch for CVE-2026-76461 today. Deploy EDR on gateway hosts. Audit outbound connections from mail infrastructure since September 1.
  • ConnectWise ScreenConnect: Patch immediately. Enforce phishing-resistant MFA on all RMM administrative access. Restrict ScreenConnect network flows to known management source IPs.
  • Chrome and Windows: Ensure current patch levels across all endpoints, especially in policy, advocacy, and NGO environments targeted by UTA0560.
  • WSO2 API Manager: Patch CVE-2026-5430. Rotate JWT signing keys. Audit API access logs for forged admin tokens from unexpected sources.
  • Acronis cPanel plugin: Update to patched version on all shared hosting infrastructure (CVE-2026-87886, CVSS 7.8, confirmed exploited).
  • Google Pixel devices: Apply September Android update for CVE-2026-58704 modem privilege escalation (limited targeted exploitation confirmed).

Detection Queries

Cisco Secure Email Gateway - hunt for unexpected root-level process execution on AsyncOS hosts using endpoint telemetry:

index=endpoint sourcetype="syslog" host="*email-gw*" OR host="*asyncos*"
  process_name!=expected_asyncos_processes
  user="root"
  | stats count by host, process_name, process_path, _time
  | where count > 0
  | sort -_time

Adapt expected_asyncos_processes to your environment’s baseline. Any novel root process on email gateway infrastructure after today’s disclosure is a high-fidelity indicator.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.