Cisco ISE, Email Security and Backup Threats for Small Businesses

Cisco disclosed CVE-2026-76461, a critical SQL injection vulnerability affecting physical and virtual Cisco Secure Email Gateway appliances.

The uncomfortable part is how the attack reaches the appliance. An attacker can send a specially crafted email through the gateway and exploit the system’s email-parsing logic. No employee needs to open the message or click a link.

If successful, the attacker may be able to run commands with root privileges. Cisco has confirmed active exploitation and says there is no workaround.

Why this matters

An email gateway is supposed to inspect hostile messages before they reach the rest of the business. It has to accept email from the internet to do that job, which also gives attackers a direct path to the vulnerable component.

Root access makes this more than a patching problem. An attacker with that level of control may be able to alter logs, remove evidence, steal credentials, access cryptographic material, or use the appliance to reach something else.

So yes, the machine responsible for inspecting suspicious email may now need to be inspected itself.

The second Cisco problem is CVE-2026-76460, a maximum-severity vulnerability affecting Cisco Identity Services Engine and ISE Passive Identity Connector.

An unauthenticated attacker can send a crafted request to a vulnerable API endpoint and bypass the web management interface. Cisco warns that successful exploitation may ultimately provide root command execution.

The vulnerability affects ISE and ISE-PIC regardless of how they are configured, and Cisco has confirmed active exploitation.

Why this matters

Cisco ISE helps decide which users and devices can join the network and what they are allowed to access afterward.

Compromising ISE is not like compromising an ordinary workstation. It potentially gives the attacker control over a system responsible for enforcing network trust.

It is the digital equivalent of walking past the security guard and taking over the desk that prints the access badges.

The next problem affects several Linux-based Acronis backup integrations.

CVE-2026-87886 is a local privilege-escalation vulnerability caused by insecure file permissions. CISA added it to the Known Exploited Vulnerabilities catalog after evidence of targeted exploitation.

Affected products include older builds of:

• Acronis Backup plugin for cPanel and WHM
• Acronis Backup extension for Plesk
• Acronis Backup plugin for DirectAdmin

Why this matters

This vulnerability requires an attacker to have some level of local access first, so it is not the same kind of direct remote attack as the Cisco vulnerabilities.

That does not make it harmless.

Hosting servers often contain multiple websites, databases, mailboxes, administrative tools, and customer accounts. Turning limited access into elevated privileges could give an attacker control over far more than the account they originally compromised.

The backup integration also sits close to the systems and recovery data you would depend on during an incident.

Backups are supposed to be the escape hatch. They should not become the attacker’s ladder.

Apple released iOS 27 and iPadOS 27 on September 14 with a long list of security fixes.

The update addresses vulnerabilities involving Bluetooth code execution, Apple Account authentication, kernel permissions, Keychain credentials, protected system files, network restrictions, and access to sensitive data.

Apple has not identified these particular issues as actively exploited, but the security content is substantial enough that businesses should not treat this as a cosmetic feature upgrade.

Why this matters

Major mobile operating-system releases are often postponed because people expect broken applications, changed interfaces, or the inevitable employee who discovers every new button before IT has finished reading the release notes.

Some caution is reasonable. Leaving business devices behind indefinitely is not.

Phones and tablets regularly contain business email, Microsoft 365 sessions, MFA applications, cloud files, saved credentials, customer conversations, and VPN access. They are business endpoints, even if employees occasionally use them to watch videos in the parking lot.

Not everything this week is another emergency patch.

CISA published new guidance on using cyber decoys to detect attackers who have already entered an environment.

These decoys can include fake credentials, documents, accounts, file shares, systems, or other resources designed to look valuable to an intruder. Because they serve no legitimate business purpose, interacting with one can generate a very high-confidence security alert.

Why this matters

Attackers increasingly use legitimate credentials and built-in administrative tools. That activity can be difficult to separate from normal IT work, particularly in an environment with limited monitoring.

A well-placed decoy changes the question.

Instead of asking, “Does this PowerShell command look suspicious enough?” you can ask, “Why did someone just use the fake administrator credential hidden where no employee should ever need it?”

That is usually a much shorter meeting.

The UK National Cyber Security Centre, FBI, and Netherlands’ AIVD released a joint advisory about CHOSEN BRICK, Windows spyware connected to Iranian state actors.

The observed campaign targets dissidents, activists, and journalists rather than ordinary small businesses. Still, the delivery method is worth understanding.

Attackers impersonate trusted contacts through WhatsApp and Telegram, spend time building rapport, and send files tailored to the victim’s interests or circumstances.

In one case, the attackers used fabricated MRI results.

The malware can capture screens, access the microphone, and collect emails, contacts, and social-media messages. It also establishes persistence so it can survive a reboot.

Why this matters

Phishing is no longer confined to email.

Employees communicate with customers, vendors, coworkers, and executives through text messages, LinkedIn, WhatsApp, Telegram, and personal accounts. Those conversations often feel more trustworthy because they are informal.

Attackers understand that. A familiar name, the correct profile photo, and one believable personal detail can carry more weight than a perfectly written email.