Cisco Zero-Days, AI Coding Agent RCEs, and a Massive ClickFix Surge Define a Critical Week in Cybersecurity
Cisco patched actively exploited zero-days in Secure Email Gateway and ISE.
The cybersecurity landscape experienced a turbulent period as defenders race to mitigate a barrage of high-severity flaws, zero-day exploits, and evolving social engineering campaigns. Enterprise networks are currently under siege from multiple vectors, ranging from foundational networking gear to cutting-edge AI developer tools. According to disclosures published in mid-September 2026, organizations must urgently review and patch critical vulnerabilities across multiple vendor products while adapting to novel attack surfaces introduced by autonomous software agents.
#Cisco Discloses and Patches Actively Exploited Zero-Days
On September 16, 2026, Cisco Advance Notification for Publication of September 16, 2026, Security Advisories detailed a series of urgent security updates for core enterprise infrastructure, including the Identity Services Engine (ISE) and Secure Firewall. Among these disclosures, two zero-day vulnerabilities stand out due to active exploitation in the wild.
The first critical flaw, designated as CVE-2026-76461, affects the email parsing logic of the Cisco Secure Email Gateway. As reported by Hackers exploit zero-day flaw in Cisco email gateway | Cybersecurity Dive, this vulnerability allows an unauthenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Attackers achieve this by transmitting a specially crafted email containing malicious SQL statements.
In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA KEV Catalog) added CVE-2026-76461 to its Known Exploited Vulnerabilities database on September 14, 2026. Federal Civilian Executive Branch agencies were mandated to apply patches by September 17, 2026.
