Sep 16: Cisco SEG in KEV, Apple 200 Patches, Japan VPN Breach

Sept. 17 is the CISA federal remediation deadline for CVE-2026-76461 in Cisco Secure Email Gateway. Active exploitation is confirmed.

Cisco SEG CVE-2026-76461: Sept. 17 deadline, root access on perimeter hardware

CVE-2026-76461 (CVSS 9.8, critical). A SQL injection in Cisco AsyncOS for Secure Email Gateway lets an unauthenticated remote attacker execute OS commands as root. CISA added it to the Known Exploited Vulnerabilities catalog on September 14 under BOD 26-04 with a September 17 federal remediation deadline.

Email security gateways sit at the internet perimeter and process all inbound traffic before it reaches internal mail infrastructure. Root access on one is not a restricted foothold. It is a privileged position on a device that handles everything before it reaches the inside of a network.

Cisco confirmed active exploitation. Apply the vendor patch per the Cisco advisory. If the patch cannot be deployed before the deadline: reduce direct internet exposure of SEG instances, add an upstream filtering layer, and segment accordingly while remediation is scheduled.

Full coverage.

Apple iOS 27 and macOS Golden Gate: 200 patches, kernel fixes included

Apple released iOS 27 and macOS Golden Gate 27 on September 15, patching approximately 200 vulnerabilities. Kernel-level fixes include memory corruption, privilege escalation, system termination, and information disclosure flaws.

Memory corruption in kernel context is the highest-priority item in that list. A working exploit there gives an attacker unrestricted control at the OS level. Privilege escalation bugs let a lower-privileged process reach kernel mode. Information disclosure from kernel memory feeds multi-stage exploit chains that bypass address space layout randomization.

No CISA KEV additions from this release at publication time. Binary diff analysis of major OS releases typically starts within hours of advisory publication. Update path: iOS: Settings > General > Software Update. macOS: System Settings > General > Software Update.

Full coverage.

September Patch Tuesday regressions: RDS and Hyper-V fixes shipped

Microsoft released emergency out-of-band updates September 14 after the September Patch Tuesday cumulative updates broke Remote Desktop Services on affected hosts. Hyper-V failures and USB audio problems were reported on some Windows versions as well.

No new security content. The OOB updates reverse the regression. RDS failures are operationally disruptive for organizations running Windows Server for remote access or virtual desktop infrastructure. The applicable update packages by Windows build are in the BleepingComputer writeup. Apply through Windows Update or the Microsoft Update Catalog.

Full coverage.

Also on the board

• Japan Digital Agency VPN breach: A flaw in a VPN appliance exposed 246,000 government personnel records. The specific CVE and vendor remain unconfirmed. Whether this was active exploitation or a misconfiguration has not been settled in the initial disclosure. VPN appliance perimeter compromise is the same pattern as the Dutch NCSC’s Check Point warning two days ago.
• CVE-2026-90919 (LightLLM, CVSS 9.8 per NVD): Unauthenticated WebSocket endpoint in the Config Server passes client-supplied frames to pickle.loads. Versions through v1.2.0 affected. If an immediate update is not possible: bind the Config Server to 127.0.0.1 and block external access to the port at the firewall. AI inference frameworks deployed in production with network-accessible endpoints warrant the same perimeter controls as any other service.
• GRIMWEDGE campaign: Targeted spear-phishing campaign exploiting recently patched Chrome and Windows flaws in a two-stage chain, per The Hacker News (September 15). Apply September Chrome and Windows cumulative patches. Attribution and campaign details are in the full article.