On Tuesday 15 September, the CSSF alerted the Luxembourg financial sector to the active exploitation of the ‘CVE-2026-76461’ vulnerability affecting the Cisco Secure Email Gateway.

The vulnerability affects the way emails are analysed by the Cisco AsyncOS software. It could allow “an unauthenticated remote attacker to execute arbitrary commands with ‘root’ privileges on the underlying operating system”, warns the CSSF’s statement.

The regulator “strongly recommends that all relevant supervised entities take due note of this report and take the appropriate measures”. Circl, the Luxembourg computer incident response centre, is monitoring the vulnerability and will publish any recommendations.

The CSSF points out that such unauthorised malicious access “constitutes a major ICT-related incident that must be reported”, in accordance with CSSF Circular 25/893 on Dora or CSSF Circular 24/847, depending on the type of entity.