Cisco Root Flaw Exploited, No Patch Timeline Set

Cisco's Secure Email Gateway has a SQL injection flaw, CVE-2026-76461, that needs no password and hands an attacker root. CISA added it to the Known Exploited Vulnerabilities catalog on September 14, confirming active exploitation rather than a theoretical lab finding. Cisco's own advisory tells customers to patch "as soon as possible," language that survives a lawyer's edit but gives nobody an actual number of hours.

Kai Tanner's desk has the mechanics: email gateways exist to parse untrusted internet traffic, so this bug needs no phishing lure and no stolen password to reach the box, and root access on a mail relay means the attacker reads everything the appliance touches. Rachel Lam's desk has the part that matters for Hong Kong specifically. HKMA pushed two scam alerts this week, September 14 and 15, warning of fraudulent sites impersonating HKICL and the banks themselves. That means the phishing traffic this bug could wave through is already being generated, not hypothetical. The compliance obligation sits under HKMA's general IT control framework, not the narrower e-banking module, and with no patch date published, the operative clock is the 21-day remediation window US federal agencies use for KEV listings. Cisco has not published a deadline of its own, so that 21-day window is the one Hong Kong bank compliance desks should be reading off now.

Elsewhere, Mei Chen's desk pairs China's total war mobilization law with the Pentagon's Taiwan Strait drone doctrine, two documents drafted by governments that are not talking to each other but are provisioning for the same fight. And in Hong Kong, Cheung Kwok-keung's desk covers John Lee's first five-year plan: a HK$30,000 cheque for a second child, paired with a public housing wait cut from six years to four.

Vendors write urgency into adjectives; a government catalog turns urgency into an enforceable number. For a Hong Kong bank running this gateway as its inbound filter, the fraudulent websites HKMA is already warning about are the exact payload this flaw would wave through. Patch against the calendar CISA already published, not against how alarmed Cisco eventually sounds.