Rapid7 tracked Linux implants on South Korean and Taiwanese edge appliances that erase their files ten seconds after launch but keep running. File scans miss them, so defenders have to hunt processes with no image on disk.
Perspective Coverage
4 publishers
- Builder
- Builder 29%
- Operator
- Operator 66%
- Investor
- Investor 5%
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+12
- Incentives35
- Confidence62
buildConfirmed2 publishers Kiteworks fixed CVE-2026-54154, a CVSS 10.0 flaw letting unauthenticated attackers run code on its Email Protection Gateway, in version 9.4.1. Other EPG flaws disclosed the same day are fixed only in 9.5.1, so internet-facing gateways should go straight to that release.
Reality
- Evidence70
- Adoption35
- Hype gap+5
- Incentives
- Not scored
- Confidence68
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
10 publishers
- Builder
- Builder 10%
- Operator
- Operator 82%
- Investor
- Investor 8%
Reality
- Evidence78
- Adoption30
- Hype gap+8
- Incentives40
- Confidence76
buildOne report1 publisher Patching FortiMail leaves the reboot-surviving ld.so.preload backdoor in place on exposed appliances
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
Cisco has already contacted Secure Email Cloud customers where it found compromise indicators
CVE-2026-76461 was in use before Monday's advisory and Cisco says multiple customers were likely compromised first, so a gateway patched this week still needs a hunt against indicators that root access can erase.
Reality
- Evidence72
- Adoption58
- Hype gap0
- Incentives55
- Confidence66
buildOne report1 publisher Cisco's remediation path for a suspect virtual email gateway starts with a new VM
For virtual appliances where exploitation is suspected, Cisco's advisory lists five actions before the box can be trusted again, one of which is installing fixed software. Owners of physical appliances are told to call TAC.
Publishers:cisco.com
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+6
- Incentives70
- Confidence62
A crafted email is already getting root on unpatched Cisco Secure Email Gateways
CVE-2026-76461 is under active exploitation, hits every physical and virtual Secure Email Gateway whatever its configuration, and has no workaround. CISA gave federal civilian agencies until September 17 to install the fixed builds.
Reality
- Evidence72
- Adoption55
- Hype gap0
- Incentives60
- Confidence68