PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 107 By PatchDayAlert

Cisco email gateway RCE at 9.8, two Office buffer overflows, and a hardcoded JWT key

CVE-2026-76461 lets an unauthenticated attacker land root on Cisco Secure Email Gateway with a single poisoned email. PraisonAI ships a default JWT secret that hands over full impersonation. Microsoft Office and Windows Graphics both carry 8.8 heap/stack overflows. Firefox 156 fixes a DevTools sandbox escape.

Patch now
2
Within 24h
1
This week
2
Exploited
0
Microsoft WordMicrosoft 365 AppsMicrosoft Office 2019Microsoft Office 365 For MacWindowsMacOSWindows 10Microsoft Graphics ComponentCisco Secure Email GatewayCisco AsyncOSNetwork AppliancePraisonAI

Two CVSS 9.8s and a trio of 8.8s landed today, none exploited in the wild yet, but don't let that make you comfortable. The headliner is CVE-2026-76461: unauthenticated root-level code execution on Cisco Secure Email Gateway via a poisoned email. No creds, no clicks, just a crafted message passing through your gateway. If you run Cisco SEG, bump this to the top of your queue right now.

Today's CVEs

Sorted by urgency

01

CVE-2026-78517

MSRC
8.8
CVSS EPSS 0.59%
Patch this week HIGH
Microsoft WordMicrosoft 365 AppsMicrosoft Office 2019Microsoft Office 365 For MacWindowsMacOS

An attacker can send a malicious Word document that triggers a heap buffer overflow, giving them code execution on the victim's machine over the network. The victim needs to open the file, but no elevated privileges are required on the attacker's side. This hits Microsoft 365 Apps, Office 2019, and Office 365 for Mac.

Affected estate
Anyone running Microsoft 365 Apps for Enterprise, Office 2019 (32-bit or 64-bit), or Office 365 for Mac
How to check
Open any Office app, go to File > Account > About, and compare the build number against the patched version in the Microsoft advisory. Alternatively, query installed Office versions via SCCM or Intune.
Included because
network-exploitable; common product; CVSS 8.8; user interaction required but document delivery is trivial
Action
Deploy the latest Office security update through Windows Update, WSUS, Intune, or the Microsoft 365 admin center. For Mac, update via Microsoft AutoUpdate.
Why it matters
A malicious document delivered by email or file share can give an attacker code execution on any workstation running a vulnerable Office version.
Source
Microsoft Security Response Center

Evidence trail

02

CVE-2026-73006

MSRC
8.8
CVSS EPSS 0.80%
Patch this week HIGH
Windows 10Microsoft Graphics ComponentWindows

A stack buffer overflow in the Windows Graphics Component lets an attacker run code remotely without authentication. Any app or service that renders graphics content on an affected system could be an entry point. No exploit has been seen in the wild yet, but the CVSS 8.8 score and network attack vector make this one worth prioritizing.

Affected estate
Windows sysadmins running Windows 10 versions 1607, 1809, or 21H2 (32-bit and x64)
How to check
Run 'winver' or query 'Get-HotFix' in PowerShell. Compare the OS build number against the patched build listed in the Microsoft advisory.
Included because
network-exploitable; unauthenticated; common OS component; CVSS 8.8
Action
Install the latest Windows 10 cumulative update for the affected version through WSUS, Intune, or Windows Update.
Why it matters
A network-reachable graphics rendering bug can give an attacker code execution on any affected Windows 10 endpoint or server.
Source
Microsoft Security Response Center

Evidence trail

03

CVE-2026-76461

NVD
9.8
CVSS
Patch now CRITICAL
Cisco Secure Email GatewayCisco AsyncOSNetwork Appliance

This is a bad one. An unauthenticated attacker can send a crafted email through your Cisco Secure Email Gateway, exploit an input validation gap in the email parser, and land root-level command execution on the underlying OS via SQL injection. No credentials needed, no user interaction, just a poisoned email flowing through the gateway. CVSS 9.8.

Affected estate
Anyone running Cisco Secure Email Gateway (AsyncOS)
How to check
SSH into the appliance and run 'version' at the CLI, or check the AsyncOS version in the web management console under System Administration > System Overview.
Included because
unauthenticated; internet-facing; root-level RCE; CVSS 9.8; no user interaction required
Action
Upgrade AsyncOS to the patched version specified in the Cisco advisory. If you cannot patch immediately, consider restricting inbound email flow or placing a secondary filter upstream.
Why it matters
An attacker can get root shell access on your email gateway by sending a single crafted email. This is internet-facing, unauthenticated, and trivial to deliver.
Source
Cisco Security Advisory

Evidence trail

04

CVE-2026-57148

NVD
9.8
CVSS
Patch now CRITICAL
PraisonAILinuxCloud

PraisonAI's platform ships with a hardcoded default JWT signing key ('dev-secret-change-me') that's active whenever the PLATFORM_JWT_SECRET environment variable isn't set. Since the platform also defaults to dev mode, an unauthenticated attacker can forge a valid JWT for any user or workspace owner and impersonate them. If you deployed PraisonAI without explicitly setting that secret, you're wide open.

Affected estate
Anyone running PraisonAI platform versions before 0.1.6, especially deployments where PLATFORM_JWT_SECRET was never set
How to check
Check the installed package version with 'pip show praisonai-platform' and verify whether the PLATFORM_JWT_SECRET environment variable is set in your deployment config.
Included because
unauthenticated; hardcoded secret is publicly known; CVSS 9.8; trivial to exploit
Action
Upgrade to praisonai-platform 0.1.6 or later. Set PLATFORM_JWT_SECRET to a strong random value and set PLATFORM_ENV to 'production'.
Why it matters
Anyone who knows (or guesses) a user ID can forge a valid auth token and take over that account or workspace with zero authentication.
Source
GitHub Advisory / NVD

Evidence trail

05

CVE-2026-92055

NVD
8.8
CVSS
Patch within 24h HIGH
Mozilla FirefoxFirefox ESRWindowsLinuxMacOS

A privilege escalation bug in Firefox's DevTools component lets an attacker elevate privileges, potentially gaining code execution beyond the browser sandbox. The attacker likely needs to lure a user to a malicious page while DevTools is open or trick them into a specific interaction. Fixed in Firefox 156 and Firefox ESR 153.3.

Affected estate
Anyone running Firefox versions before 156 or Firefox ESR versions before 153.3
How to check
Open Firefox, go to Help > About Firefox and check the version number. For managed fleets, query the installed Firefox version via SCCM, Intune, or your package manager.
Included because
privilege escalation; CVSS 8.8; widely deployed browser; fix already available
Action
Push Firefox 156 (or ESR 153.3) through your software distribution system. Verify the update landed on managed endpoints.
Why it matters
Privilege escalation through DevTools can let an attacker break out of normal browser restrictions, especially dangerous on developer workstations where DevTools is frequently open.
Source
Mozilla Foundation Security Advisory

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →