What landed in CVE-land this week

CISA added seven CVEs to the Known Exploited Vulnerabilities catalog ahead of 2026-09-19. The entry that demands the closest read is CVE-2026-76461, a Cisco Secure Email Gateway bug added on 2026-09-14: an unauthenticated, remote SQL injection in Cisco AsyncOS that yields arbitrary command execution as root on the underlying operating system. That is a full-stack collapse from a single unauthenticated request against a mail perimeter appliance. This piece leads with it, then covers one of the newer Linux kernel entries.

CVE-2026-76461: SQLi to root on a mail gateway

CISA's KEV entry describes the flaw as a SQL injection in the AsyncOS software for Cisco Secure Email Gateway (SEG) that lets an unauthenticated, remote attacker execute arbitrary commands with root privileges on the underlying operating system. The attacker needs no credentials, no foothold on the management network, and is not limited to database exfiltration. The path is injection to OS command execution to root.

An appliance-hosted SQLi with an OS-command sink typically takes one of three shapes: a stacked query that pivots into a database function that shells out, a UNION-driven read of an admin secret that is then replayed against a control-plane endpoint, or a query interpolated into a shell command server-side. Any of those three, combined with root, gives an attacker persistence on the mail path: mailflow policy edits, DKIM key theft, TLS material extraction, log tampering, and mailbox rules for downstream tenants that route through the gateway.

The exposure questions are direct:

If you cannot answer all three in under an hour, that is the finding, independent of the CVE. A defensible SEG deployment isolates management, denies outbound to anything other than mail peers, log sinks, and update endpoints, and alerts on any process spawned from the web-management daemon outside a short allowlist.

Root command execution from the AsyncOS web-management process is a hard, high-fidelity detection signal. A minimal detection sketch against a normalized process-tree schema, populated from EDR or auditd on the underlying OS:

process_start
  where parent.name in ("webui", "gui_server", "tomcat", "java")
    and parent.image_path startswith "/opt/cisco/"
    and user.euid == 0
    and process.name in ("sh", "bash", "python", "python3", "perl", "curl", "wget", "nc")
| stats count by host, parent.name, process.name, process.cmdline

The query's value is not completeness: the parent set is small, the child set is small, and the euid pin keeps false positives rare. If you lack the telemetry to write it, that is a second finding. Appliances carrying business-critical traffic need at least off-box syslog with process and authentication events, or a documented decision to accept their opacity.

Under BOD 26-04, which took effect on 2026-06-10 and extends the KEV remediation criteria from the prior directive, in-scope federal agencies must remediate KEV entries on the schedule the catalog assigns. Private-sector teams are not bound by that directive, but if your risk register uses KEV membership as a prioritization signal (and it should), an unauthenticated remote SQLi to root on a mail perimeter appliance is a stop-the-line item. Apply the vendor fix, rotate any secrets the appliance held, then move on.

CVE-2025-39682: TLS receive-path record-type confusion in the Linux kernel

CVE-2025-39682 was added to KEV on 2026-09-18. CISA describes it as an improper check for unusual or exceptional conditions in the Linux kernel's TLS receive path: a zero-length record retrieved from the rx_list can bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed under incorrect zero-copy and queuing assumptions. CISA also flags that impacted products may be end-of-life or end-of-service and advises transition to a supported version.

Kernel TLS (kTLS) offloads the TLS record layer into the kernel so that user space reads and writes plaintext through a normal socket. recvmsg() on a kTLS socket pulls records from rx_list, honors the record type (application data versus control records such as alert or handshake), and reports the type to user space via a control message. If a zero-length record slips past the type check, the state machine's assumption that the next record is application data no longer holds. Subsequent reads may be dispatched under the wrong zero-copy and queuing path; that is precisely the kind of primitive that becomes memory corruption or cross-context data confusion when an attacker can shape the record sequence.

The exposure question is not whether you use TLS (you do). It is whether you use kernel TLS. That answer is specific and greppable: load balancers, high-throughput reverse proxies, and some database and object-storage front ends opt into kTLS with setsockopt(TCP_ULP, "tls") and then configure TLS_TX/TLS_RX. A quick inventory on a Linux host, without waiting for a fleet scanner:

# Which kernels are running?
uname -r

# Is the tls module loaded, and by whom?
lsmod | grep -w tls
ss -tlnp | awk 'NR>1 {print $NF}' | sort -u

# Any process actively using the TLS ULP right now?
sudo ss -tie state established | grep -E 'tls'

If tls is loaded and any long-lived front-door daemon appears in the last command, that host is in scope for CVE-2025-39682 and needs the kernel update. If the KEV EoL/EoS caveat applies to your distribution or vendor kernel, patching is not an option: the path is migration, or disabling kTLS in the affected daemons as a stopgap so that TLS terminates in user space where the flaw does not apply.

The rest of this week's KEV additions (the ebtables SNAT out-of-bounds write in CVE-2026-53266, the AF_ALG race in CVE-2025-39964, the Acronis Backup default-permissions bug in CVE-2026-87886, the Cisco ISE unauthenticated bypass in CVE-2026-76460, and the Google Pixel modem authorization bug in CVE-2026-58704) deserve their own treatment, but they are not what makes this week's catalog different. The mail-gateway root and the kTLS record-type confusion are.

Verifiable security.