Cisco's advisory for CVE-2026-76461 describes SQL injection in AsyncOS Software for Secure Email Gateway, an unauthenticated flaw carrying a CVSS score of 9.8 that CISA added to its Known Exploited Vulnerabilities catalog on September 14. The path from injection to root is short: the vulnerable component sits on the mail relay, which by design already has network reach into internal systems. That is the placement every gateway appliance shares. It is also why it keeps getting hit first.

Cisco's own advisory language urges customers to patch "as soon as possible," which is the sentence every vendor writes the week CISA's KEV entry does the actual work of setting the deadline. For an APAC bank running Secure Email Gateway as its inbound mail filter, the KEV listing means the 21-day remediation clock that US federal civilian agencies operate under is now the de facto industry benchmark, not a US government footnote. Root access on a mail gateway means an attacker reads every inbound message before a spam filter does, including the ones carrying wire instructions.

The one artifact that matters here is the KEV catalog date, September 14, set against whatever date a given bank's patch ticket actually closes. Cisco has not published a specific exploited-in-the-wild count or named the actor. The control that would have changed the outcome is disabling remote administrative access to the AsyncOS management interface until the patch lands, which Cisco's advisory lists as a workaround and which costs nothing to apply today.