# Daily IT Digest – September 16, 2026

> Sep 16, 2026 · #security #cisco #android

A critical Cisco Secure Email Gateway flaw is already under active attack, a phishing campaign hides fraudulent emails using invisible Unicode characters, and Android patches 180 vulnerabilities.

## 1. Critical Cisco Secure Email Gateway flaw already under active exploitation

Cisco has confirmed vulnerability CVE-2026-76461 (CVSS 9.8) in its Secure Email Gateway (both physical and virtual appliances). The flaw stems from insufficient validation when parsing incoming emails – an attacker can embed SQL statements inside an email and, without any authentication whatsoever, execute arbitrary commands with root privileges. Affected are versions 15.5 and earlier (fixed in 15.5.5-0141), 16.0 (fixed in 16.0.4-302), and 16.5 (fixed in 16.5.0-780). CISA has already added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and ordered US federal agencies to patch by September 17; no workaround is available.

> **Why it matters:** this is about as severe a combination as it gets – the attacker needs no credentials and no user interaction, just a single delivered email, and gains full control of the device. Cisco also warns that attackers with root access can wipe their traces from the logs, so if your organization runs one of these appliances, the update should happen today, along with a check of mail logs for suspicious SQL statements.

## 2. Phishing campaign hides fraudulent words using invisible Unicode characters

Security researchers (originally Microsoft) have documented a large-scale phishing campaign that inserts invisible Unicode "tag" characters into keywords like "funding" (e.g. "fun[invisible character]ding") – the text looks completely normal to the recipient, but signature-based filters fail to recognize the keyword. The campaign posed as small-business loan and credit-line offers (echoing SBA-style lending programs) and at its peak sent up to 2.37 million emails a day. It was delivered through the legitimate marketing platform ActiveCampaign, whose good IP reputation also let it slip past reputation-based filters.

> **Why it matters:** the technique shows that even everyday, trustworthy-looking marketing tools can be abused by attackers to bypass email protections – the usual "check the sender's domain" training isn't enough here, since the email genuinely arrives from a legitimate platform. Small and medium businesses are a direct target (loan and financing offers), so it's worth alerting finance and procurement staff in particular to verify such offers through a separate channel rather than clicking the link in the email.

## 3. Android's September update patches 180 vulnerabilities

Google has released its September security bulletin for Android, fixing 180 vulnerabilities across two patch levels (95 at the 2026-09-01 level and another 85 at 2026-09-05), including 23 critical flaws in the System component. The most severe is CVE-2026-28662, a Wi-Fi-related memory corruption flaw that enables remote code execution with no additional privileges or user interaction required. The same fixes also roll out to Wear OS, Android XR, and Android Automotive OS.

> **Why it matters:** in companies with a bring-your-own-device (BYOD) policy, employees' personal phones access company email, documents, and VPN – a critical Wi-Fi flaw that needs no user interaction is exactly the kind of bug that could be exploited over, say, public Wi-Fi at a café or airport. We recommend reminding employees to install the update on their phones as soon as possible, ideally pushed through your company's MDM solution if you use one.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-16-it-daily-roundup.html