Cisco make-me-root email bug exploited as a 0-day by unknown crims

security

Both Switchzilla and CISA sound the alarm

Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.” 

The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system – simply by sending a malicious email. In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. 

The US…