Cisco Email Gateway RCE, Apple Auth Bypass Hit KEV

Cisco Secure Email Gateway is vulnerable to remote command execution with root privileges due to a flaw in email parsing. This critical vulnerability, CVE-2026-76461, has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild, as reported by The Register Security and CyberScoop. The vulnerability allows unauthenticated, remote attackers to gain control of the underlying operating system. Cisco has released patches to address this issue.

Apple has released security updates for macOS, addressing an authentication issue in its Screen Sharing service. CVE-2026-65400, a critical vulnerability, was fixed in various macOS versions including macOS Golden Gate 27, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. This flaw could allow a network-based attacker to bypass authentication. The vulnerability has been added to the CISA KEV catalog and has been observed in the wild, with reports from Cyber Security News indicating its use for deploying cryptominers.

A critical vulnerability in the CryptoPayment Gateway WordPress plugin, versions 1.2.1 to 1.2.2, allows unauthenticated users to perform administrative operations, including arbitrary file deletion. CVE-2026-81648, with a CVSS score of 10.0, poses a significant risk due to the lack of authorization checks on its AJAX endpoints. This could lead to severe data loss or system compromise on affected WordPress sites.

Several critical vulnerabilities have been disclosed in Apache Syncope, a platform for managing identities and access. These flaws, including CVE-2026-82232 (SQL Injection) and CVE-2026-73668 (Incorrect Authorization), allow attackers to execute arbitrary code, bypass security controls, and gain elevated privileges. Cyber Security News highlights that these vulnerabilities could enable attackers to execute malicious code and bypass existing security measures. Patches are available for affected versions.

CVE-2026-91998, a critical authorization bypass vulnerability in Casdoor through version 4.4.0, allows any authenticated application to gain unrestricted administrative access across all organizations. This flaw in the /api/mcp endpoint poses a significant risk to organizations using Casdoor for identity and access management, potentially leading to widespread unauthorized access and data breaches.

D-Link's DI-8400 router is affected by CVE-2026-91001, a critical vulnerability in its DDNS Configuration component. This flaw allows for manipulation of arguments within the ddns.asp file, potentially leading to unauthorized access or system compromise. The vulnerability affects firmware version 16.07.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains CVE-2026-16338, a critical vulnerability that permits remote authenticated attackers to perform arbitrary file writes due to improper validation of file paths. This could allow attackers to overwrite critical system files or inject malicious content, leading to system instability or compromise.

Crawlab through version 0.6.3 has a critical vulnerability, CVE-2026-90945, stemming from a hard-coded HMAC-SHA256 secret used for JWT token signing. This allows unauthenticated attackers to forge administrator tokens, granting them access to administrative functions and sensitive data within the Crawlab environment.

Cisco has also disclosed CVE-2026-76443 and CVE-2026-76440, both critical vulnerabilities identified during internal security reviews of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. While specific details are limited, these findings underscore a continued focus on security within Cisco's email security products.

Apache's SimpleACLAuthorizer component is affected by CVE-2026-82431, a critical authorization vulnerability. This flaw could allow unauthorized access to cluster resources if access is restricted by group alone, without considering user-level permissions.

Apache Syncope is further impacted by CVE-2026-73370, CVE-2026-77181, CVE-2026-75030, CVE-2026-73668, and CVE-2026-73579, all critical authorization and privilege management vulnerabilities. These flaws could allow unauthorized actions related to delegated administration, client app management, task execution, and data access across different realms.

CVE-2026-78330, another critical Apache Syncope vulnerability, involves incorrect privilege assignment. If internal JWT authentication settings are disclosed, an attacker can obtain administrative privileges.

CVE-2026-86460, a critical Cypher injection vulnerability in Apache Syncope's Neo4j persistence layer, allows for the injection of malicious queries when processing specific search conditions.

CVE-2026-82232, a critical SQL injection vulnerability in Apache Syncope, allows administrators with adequate entitlements to execute arbitrary SQL commands via stacked queries.

CVE-2026-73470, a critical improper privilege management vulnerability in Apache Syncope, allows for the creation or update of delegations with Roles not owned by the delegating User or for unrelated Realm subtrees.