On 14 September 2026, CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of a critical SQL injection flaw in Cisco Secure Email Gateway. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges. Dark Reading reported that Russian threat actor Sandworm is chaining Cisco vulnerabilities to deploy Cyclops Blink malware, a sophisticated implant that harvests credentials and maintains persistent access. The same day, D-Link disclosed critical buffer overflow and command injection vulnerabilities in three router models (DIR-823G, DIR-878, DWR-M921), scoring up to 9.9 on CVSS, with public exploit code already available. Most UK small businesses do not operate their own email filtering infrastructure but rely on managed service providers whose patch status directly affects their risk exposure. Similarly, consumer-grade routers are frequently deployed and forgotten, with no active firmware management process. This episode provides specific mitigation steps: confirming patch status with MSPs, auditing router inventory, restricting management interfaces to local networks, and establishing defined response times for CISA KEV items in service agreements.
