Cisco's advisory on CVE-2026-76461 describes a SQL injection vulnerability in Secure Email Gateway, CVSS 9.8, added to the CISA Known Exploited Vulnerabilities catalog on September 14. It landed one day after Cisco confirmed CVE-2026-764, a separate flaw in the same AsyncOS software that lets attackers execute commands as root, was already under active exploitation. Two critical bugs, same product line, same week, both with root-level consequences. Cisco's advisories treat them as unrelated disclosures. The artifacts show a mail gateway that was reachable by two different unauthenticated paths at once.

Secure Email Gateway sits at the perimeter by design, parsing inbound mail before anything else touches it, which is exactly why root access there is worse than root access on an internal box. A SQL injection that reaches that privilege level means the authentication layer in front of the database was never the control doing the work. Sandworm's revival of the Cyclops Blink botnet through separate Cisco bugs this week is a reminder that Cisco edge devices are a standing target list, not a one-off. An APAC bank running Secure Email Gateway as its inbound filter now has two September patches to apply to the same appliance, not one, and the second was issued only after KEV listing forced the clock to start.

Cisco is named in both CVEs and in the Sandworm reporting, the only vendor to appear in all three threads this week. The mitigating control is patch sequencing: CVE-2026-764 and CVE-2026-76461 both require the AsyncOS update, and a gateway patched for one while still exposed to the other was never actually closed. The fix that matters is the one still pending on the appliance, not the one already applied.