Cisco zero-day, Japan breach, WSO2 exploitation

Cisco patches exploited email gateway zero-day granting root access

Cisco disclosed CVE-2026-76461, a critical SQL injection flaw in Secure Email Gateway appliances that attackers exploited in September to execute commands with root privileges via crafted emails. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by September 17. Cisco warned that attackers with root access can erase forensic evidence, and urged organizations to check network logs outside affected devices for signs of compromise. [1]

Japan Digital Agency discloses breach affecting 246,000 government records

Japan's Digital Agency disclosed that attackers exploited a medium-severity VPN vulnerability to access approximately 246,000 records containing names, email addresses, and phone numbers of government employees and officials. The agency detected the breach in late June and confirmed the VPN exploit in July, but delayed public disclosure until September 11. The compromised data belonged to users of the Government Solution Service, a shared IT platform across Japanese ministries. [2]

WSO2 API Manager authentication bypass now under active exploitation

Security firm watchTowr reported active exploitation attempts targeting CVE-2026-5430, a critical JWT authentication bypass in WSO2 API Manager disclosed in August. The flaw allows attackers to forge admin tokens by submitting JWTs signed with unsupported algorithms, potentially leading to full account takeover. Honeypot networks captured exploit attempts with forged administrator privileges arriving September 13. [3]