Cisco make-me-root email bug exploited as a 0-day by unknown crims

Cisco has urged customers to patch a critical "make-me-root" vulnerability in its Secure Email Gateway (SEG) product. This zero-day exploit allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance's operating system by sending a malicious email. The vulnerability, tracked as CVE-2026-76519, received a 9.8 out of 10 CVSS rating and has already been exploited in the wild.

Cisco's spokesperson confirmed active exploitation of the vulnerability, but declined to provide details on the number of compromised appliances or the actions attackers took after gaining access. The flaw exists in the SEG's Advanced Malware Protection (AMP) feature due to improper handling of email attachments. A successful exploit requires the File Reputation service to be enabled and assigned to a mail policy, and the Content Scanner Tools version to be earlier than 25.3.0.5525.

Cisco recommends upgrading to a fixed software release and following additional hardening guidance in their advisory. The vulnerability has been added to the US government's Known Exploited Vulnerabilities catalog, with a deadline for federal agencies to fix the issue. This is the second zero-day exploit in Cisco SEG in two months, with a similar bug exploited in mid-September.