The Exploit Bulletin — Tuesday, September 15, 2026: 6 issues require action
Tuesday, September 15, 2026 — 6 issues require action. If you run none of the software below, you are done.
Affects: Cisco AsyncOS for Cisco Secure Email Gateway · Cisco Secure Email · The Events Calendar · WooCommerce Wholesale Lead Capture · npm/is · npm package 'is' · Crawlab (distributed web crawler management platform) · Crawlab · IBM Db2 Mirror for i (web GUI)
1. Unauthenticated SQL injection via crafted email gives root command execution on Cisco Secure Email Gateway (CVE-2026-76461)
CISA KEV (due 2026-09-17) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Cisco published the advisory and CISA added the CVE to KEV on 2026-09-14 with a 2026-09-17 remediation deadline; any Secure Email Gateway that keeps accepting mail on a vulnerable AsyncOS release can be rooted by a single inbound message with no credentials.
Insufficient validation in the email parsing logic of Cisco AsyncOS for Secure Email Gateway lets an unauthenticated remote attacker send a crafted email containing SQL statements through the appliance and turn that into arbitrary command execution as root on the underlying OS. Physical and virtual appliances are affected regardless of configuration, and Cisco has no workaround.
Affected: Cisco AsyncOS for Cisco Secure Email Gateway prior to 15.5.5-014; Cisco AsyncOS for Cisco Secure Email Gateway prior to 16.0.4-302; Cisco AsyncOS for Cisco Secure Email Gateway prior to 16.5.0-780; Cisco Secure Email 13.0.0-392, 13.0.5-007, 13.5.1-277, 13.5.4-038, 14.0.0-698, 14.2.0-620, 14.2.1-020, 14.3.0-032, 15.0.0-104, 15.0.1-030
How to Test: Check the AsyncOS release on each Secure Email Gateway (physical or virtual) via the appliance's version display; anything below 15.5.5-014, 16.0.4-302 or 16.5.0-780, including the 13.x/14.x/15.0.x builds listed above, is vulnerable regardless of configuration. Secure Email and Web Manager is confirmed not affected. Because exploitation arrives as an inbound email, review mail and system logs on the appliance for unexpected commands, new processes or persistence artifacts, and treat any appliance that was exposed to internet mail on a vulnerable release as potentially compromised pending review.
How to Patch: Upgrade Cisco AsyncOS for Secure Email Gateway to 15.5.5-014, 16.0.4-302 or 16.5.0-780 (or later) as appropriate for your release train. Cisco states there are no workarounds for this vulnerability, so the upgrade is the only remediation.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA adds CVE-2026-76461 to KEV based on evidence of active exploitation · BleepingComputer: Cisco patches Secure Email Gateway zero-day exploited in attacks · The Hacker News: Cisco Secure Email Gateway flaw exploited in the wild
2. Unauthenticated PHP object injection to RCE in The Events Calendar WordPress plugin (CVE-2026-78006)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
VulnCheck added this flaw to its KEV catalog on 2026-09-12 and a public exploit is available in VulnCheck XDB, so any site still on 6.17.4 or earlier can be taken over by an unauthenticated attacker who picks up that exploit.
The plugin's V2 widget-rendering pipeline lets an unauthenticated request reach unserialize(): enable_rendering_widget_copied() forges a valid wp_hash integrity attribute and the is_safe_widget_instance() guard is bypassed because PHP fires magic methods during pre-parse. The result is code execution on the web server for any site running 6.17.4 or earlier; the plugin is active on more than 600,000 sites.
Affected: The Events Calendar (WordPress plugin) <= 6.17.4
How to Test: Check the installed plugin version on the WordPress Plugins page (or with wp plugin list); anything at or below 6.17.4 is vulnerable. To look for compromise, review web server logs for unauthenticated requests hitting the plugin's V2 widget-rendering paths, and inspect the site for unexpected PHP files, modified plugin/theme files, new administrator accounts, or scheduled tasks created since early September.
How to Patch: Update The Events Calendar to 6.17.4.1 (the patched release identified by Patchstack). If the update cannot be applied immediately, deactivate the plugin until it can.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit
3. Unauthenticated arbitrary file upload in WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.0
Wordfence reported on 2026-09-14 that attackers are actively exploiting this flaw against sites still on 2.0.3.1 or earlier, so an unpatched store can be turned into a webshell host by anyone scanning for it.
The Wholesale Lead Capture plugin for WooCommerce accepts file uploads of dangerous types from unauthenticated users in versions up to 2.0.3.1, allowing an attacker to place a PHP file (webshell) on the web server and take over the site.
Affected: WooCommerce Wholesale Lead Capture (Rymera Web Co) <= 2.0.3.1
How to Test: Check the plugin version on the WordPress Plugins page or via wp plugin list; anything at or below 2.0.3.1 is vulnerable. Look for compromise by searching the wp-content/uploads tree and the plugin directory for unexpected .php or double-extension files, reviewing web server logs for unauthenticated POST requests to the plugin's upload handling endpoints, and checking for new administrator users or modified core files.
How to Patch: Update WooCommerce Wholesale Lead Capture to 2.0.3.2 (the patched release identified by Patchstack). If the premium update cannot be obtained immediately, deactivate the plugin until it can.
Evidence: VulnCheck KEV · Wordfence: attackers actively exploiting (2026-09-14)
4. npm 'is' published malicious versions after maintainer account takeover
SUPPLY-CHAIN COMPROMISE · CRITICAL
The registry advisory landed on 13 September and unpinned CI jobs and fresh npm install runs keep resolving the package this week; a build agent that ran a poisoned version should be treated as having leaked every token in its environment.
The npm registry advisory GHSA-6f4g-3jvw-4j45 records that unauthorized versions of the widely depended-on npm package 'is' were published from a compromised maintainer account and contained obfuscated malicious code. 'is' is pulled in transitively by large numbers of JavaScript build trees, so any unpinned install or CI resolution during the publish window could have executed attacker code on build hosts with access to environment secrets.
Affected: npm package 'is' — the unauthorized versions published during the maintainer account compromise, as enumerated in GHSA-6f4g-3jvw-4j45 (all other versions unaffected)
How to Test: Grep package-lock.json / yarn.lock / pnpm-lock.yaml across all repos for a resolved 'is@' version matching the advisory list, run npm ls is to find transitive pulls, inspect ~/.npm/_cacache and CI runner caches and Artifactory/Verdaccio mirrors for tarballs of those versions, and review build-agent egress and npm-token usage logs for the publish window.
How to Mitigate: Pin or upgrade 'is' to a known-good version listed in the advisory, purge npm/CI caches and any internal registry mirror copies of the malicious tarballs, rebuild affected artifacts, and rotate every secret exposed to hosts that installed them (npm publish tokens, CI variables, cloud keys, SSH deploy keys).
Evidence: Vendor confirmed
5. Hard-coded JWT signing secret enables token forgery and auth bypass (Crawlab)
UNVERIFIED PUBLIC REPORT · NO CVE · AUTHENTICATION BYPASS · CRITICAL
A CVE with CVSS 9.8 and public threat-intel coverage appeared 2026-09-14 for a self-hosted platform frequently exposed on internal and internet-facing hosts.
Crawlab through 0.6.3 ships a hard-coded HMAC-SHA256 secret used to sign JWT session tokens, and it cannot be overridden via configuration or environment variables. An unauthenticated attacker who knows the key can forge valid admin tokens and take over the deployment. No vendor statement is quoted here.
Affected: Crawlab through 0.6.3
How to Test: Check your Crawlab version (<= 0.6.3 is affected); if the JWT secret cannot be set via config/env, you are running the vulnerable build. Watch for logins or API calls using tokens you did not issue.
How to Mitigate: Place the Crawlab interface behind authentication/VPN and off the public internet; upgrade to a fixed release that allows overriding the JWT secret as soon as one is published.
Evidence: NVD entry
6. Pre-auth authentication-filter bypass leading to RCE and QSECOFR (IBM Db2 Mirror for i)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
A credible research firm published a working pre-auth RCE chain on 2026-09-14 with no vendor fix identified, leaving exposed administrative interfaces at immediate risk.
Silent Signal describes a bug chain in the IBM Db2 Mirror for i web GUI: a semicolon path-parameter trick (e.g. /Db2MirrorServlet;x/...) makes AuthFilter skip its session, BuildTimeStamp and MN checks while the container still routes the request, and an unauthenticated skipVald switch disables input validation. Chained, these reach arbitrary action methods, Java/JSP execution in Liberty, and escalation to QSECOFR on the local IBM i. No CVE, no IBM advisory, and no affected-version range are yet published.
Affected: not stated — the report concerns the IBM Db2 Mirror for i GUI WAR on the IBM i Liberty instance, tested on IBM i V7R5 with a late-2025 GUI build
How to Test: Check whether the Db2 Mirror for i GUI (Db2Mirror.war on the administrative Liberty instance) is deployed and network-reachable; test whether GET /Db2MirrorServlet;x/DbmConfigAction?function=getAppInitData returns application init JSON instead of 401/403, which indicates the filter bypass.
How to Mitigate: There is no confirmed fix; restrict the Db2 Mirror web interface to trusted management networks, block external access, and apply IBM updates once an advisory/patch is released.
Evidence: Silent Signal write-up
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
