Look, CVE-2026-76461 is the story a bank's operational-technology desk actually has to act on today. Kai's filing covers Cisco's Secure Email Gateway flaw (unauthenticated SQL injection to root, CVSS 9.8), added to CISA's Known Exploited Vulnerabilities catalog on September 14 with active exploitation already confirmed. Nothing in today's HKMA notices touches it directly, the two September 15 releases are a scam alert and Exchange Fund Bills tender results, and neither changes an obligation. So the gateway flaw sits where it always sits for a Hong Kong bank: general technology risk governance, not a channel-specific rule.

HKMA's Banking Supervision Department doesn't have a module numbered for "patch your mail relay," and TM-E-1 only reaches e-banking channels, not the inbound mail gateway sitting in front of the corporate network. The obligation that actually lands is SPM TM-G-1's continuous technology risk management process (the general module, institution-wide, not channel-specific), which requires a bank to have a process for exactly this: identify, patch, verify. CISA's 21-day federal remediation clock isn't binding on a Hong Kong bank (nobody at Banking Supervision Department enforces a US agency's deadline), but it's the number examiners will ask about anyway when they review whether TM-G-1's process worked or just existed on paper. Cisco has not published a patch timeline as of this filing, which means the clock is running against a fix that doesn't exist yet.