Cisco's advisory for CVE-2026-76461 describes unauthenticated SQL injection in AsyncOS for Secure Email Gateway, CVSS 9.8, sitting on the mail relay that every gateway appliance places with network reach into internal systems (Kai Tanner's filing today). CISA added it to the Known Exploited Vulnerabilities catalog September 14. Separately, HKMA's press office pushed two scam alerts this week, on September 14 and 15, flagging fraudulent websites impersonating HKICL and the banks themselves.

Look, Cisco's own advisory tells customers to patch "as soon as possible," which is the sentence every vendor writes the week the actual deadline gets set somewhere else. For a Hong Kong bank running Secure Email Gateway as its inbound filter, CVE-2026-76461 isn't scoped to HKMA's e-banking module, TM-E-1 covers Internet banking, contactless payments and card-not-present transactions, not the mail relay a phishing kit rides in on. The obligation here sits with the Banking Supervision Department's technology risk oversight under TM-G-1, the general IT control framework, and it isn't module-specific: fix the exploited component before the scam emails HKMA is already publicly warning about start arriving through it. The 21-day remediation window US federal civilian agencies operate under on KEV entries is the de facto clock every bank compliance desk should be reading off now, not Cisco's open-ended "as soon as possible."

CISA's KEV catalog updates continuously, so the next observable event is whenever Cisco issues a fix, there's no patch timeline in the advisory as of September 14. Until Cisco publishes one, the KEV listing date, not a vendor deadline, is the only clock running.