We’re Tracking the Future of Security

Tag: Email Security

  • Kiteworks Patches Maximum-Severity Email Protection Gateway Flaw

    Kiteworks Patches Maximum-Severity Email Protection Gateway Flaw

    Kiteworks has released security updates addressing 126 vulnerabilities, including a maximum-severity flaw in its Email Protection Gateway. The most serious issue, tracked as CVE-2026-54154, can enable remote code execution without authentication when several weaknesses are chained together.

    The attack path crosses multiple weaknesses

    According to the public reporting and CVE record, the chain combines path traversal, code injection and missing authentication. An attacker able to reach a vulnerable gateway could potentially execute code remotely. The risk is significant because email-security gateways commonly sit near an organization’s external boundary and may process untrusted content.

    Use the vendor’s release guidance

    Administrators should identify every deployed Email Protection Gateway, consult Kiteworks guidance for the applicable supported release and apply the prescribed fixes. The public sources reviewed for this report do not justify inventing affected or fixed version numbers. Teams should also restrict management exposure, review gateway logs for unexpected activity and verify that credentials or trust relationships available to the appliance cannot be used for lateral movement. Patch validation should include service health and security logging, not only a successful installation message. Additional vulnerability updates are tracked in the SectechMedia Technology News archive.

    Sources

  • Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

    Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

    Canada’s Cyber Centre has warned that attackers are actively exploiting a patched Roundcube Webmail vulnerability. Tracked as CVE-2026-48842, the flaw affects the virtuser_query plugin and can permit SQL injection before a user authenticates.

    What the advisory confirms

    Roundcube released fixes in versions 1.6.16 and 1.7.1 on May 24. The project described the issue as a security defect involving query handling, while the Canadian advisory now adds evidence of exploitation in the wild. The available notices do not disclose a detailed campaign profile, so attribution and victim counts remain unconfirmed.

    The risk depends on whether the vulnerable plugin is enabled and how the database is configured. Successful injection could expose information held by the webmail backend, including data that may support further account compromise. Internet-facing email systems are especially sensitive because they combine identity, communications and recovery workflows.

    Immediate defensive actions

    Administrators should identify Roundcube versions and enabled plugins, upgrade to a fixed release, review web and database logs for unusual query patterns, and rotate affected credentials if compromise is suspected. Restricting unnecessary public exposure and applying least privilege to the database account can reduce impact. SectechMedia covers connected defensive controls in its cyber-physical security channel.

    Sources

  • Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco has disclosed CVE-2026-76461, a vulnerability affecting Secure Email Gateway and Secure Email and Web Manager software that can allow an unauthenticated attacker to execute commands with root privileges under vulnerable conditions. Cisco’s advisory provides the affected-version and remediation details.

    The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 14, confirming evidence of exploitation in the wild. That designation does not identify every victim or attacker, but it materially changes patch priority.

    Email gateways are high-value perimeter systems because they inspect untrusted content and often hold privileged network positions. Defenders should follow Cisco’s exact guidance, review appliance logs and avoid relying on exposure assumptions that have not been tested.

    Why it matters

    An exploited edge-device vulnerability can bypass controls deeper inside the network. Asset owners need authoritative version checks, rapid remediation and post-compromise review, because installing a fix does not by itself remove persistence created before patching.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • CISA Deadline Passes for Federal Agencies to Patch Actively Exploited Zimbra Flaw

    CISA Deadline Passes for Federal Agencies to Patch Actively Exploited Zimbra Flaw

    August 24, 2026, was the deadline for US federal civilian executive branch agencies to mitigate or discontinue use of Zimbra Collaboration Suite (ZCS) systems affected by CVE-2026-73570, a critical, actively exploited remote-code-execution flaw, after the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on August 21, according to reporting from Dark Reading and The Hacker News.

    Background on the flaw

    Zimbra disclosed CVE-2026-73570, a command-injection vulnerability in the optional zimbra-snmp component that can allow unauthenticated remote code execution when SNMP notifications are enabled, and released a patched version, ZCS 10.1.20, on July 20, 2026. Poland’s CERT Polska warned on August 16–17 that the flaw was being actively exploited in the wild, and BleepingComputer reported on the active exploitation campaign on August 20. CISA added the vulnerability to its KEV catalog on August 21 and required federal civilian agencies to remediate by August 24.

    Why it matters

    Zimbra Collaboration Suite is widely used email and collaboration software across businesses and government agencies. An unauthenticated remote-code-execution flaw in internet-facing collaboration infrastructure, already confirmed as being actively exploited before a patch was applied everywhere, is exactly the scenario CISA’s KEV deadlines are designed to force organizations to act on quickly. Security teams running Zimbra Collaboration Suite that have not yet applied version 10.1.20 or later, or disabled the affected SNMP component, should treat this as an active, ongoing exploitation risk rather than a theoretical one.

    Sources

    More coverage like this is available on Technology News.