Cisco make-me-root email bug exploited as a 0-day by unknown crims

Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.” The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system - simply by sending a malicious email. In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue. …