Cisco make-me-root email bug exploited as a 0-day by unknown crims
Attackers are exploiting Cisco Secure Email Gateway zero-day CVE-2026-76519 for unauthenticated root access via email.
Cisco and CISA warned that CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway, was exploited as a zero-day before a fix. Unauthenticated attackers can send a malicious email attachment and, when Advanced Malware Protection File Reputation is enabled and Content Scanner Tools are older than 25.3.0.5525, write files and execute commands as root on physical or virtual AsyncOS appliances. Cisco says a limited number of customers are affected, there is no workaround, and vulnerable releases should move to fixed software, with pre-16.5 systems migrated to 16.5.0-780. CISA added the bug to the KEV catalog with a Saturday federal deadline. It follows exploited SEG flaws CVE-2026-76461 and CVE-2025-20393.