--- title: Cisco make-me-root email bug exploited as a 0-day by... description: Cisco is urging customers to patch a critical, actively exploited zero-day (CVE-2026-76519, CVSS 9.8) in its Secure Email Gateway's Advanced Malware Protection... canonical: https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco make-me-root email bug exploited as a 0-day by unknown crims | daily.dev og:description: Cisco is urging customers to patch a critical, actively exploited zero-day (CVE-2026-76519, CVSS 9.8) in its Secure Email Gateway's Advanced Malware Protection... og:url: https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj og:image: https://api.daily.dev/og/posts/aSfRYfVHj.png og:image:alt: Cisco make-me-root email bug exploited as a 0-day by unknown crims og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco make-me-root email bug exploited as a 0-day by unknown crims **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Cisco is urging customers to patch a critical, actively exploited zero-day (CVE-2026-76519, CVSS 9.8) in its Secure Email Gateway's Advanced Malware Protection feature. Unauthenticated attackers can gain root access on physical or virtual SEG appliances simply by sending a malicious email attachment, exploiting improper attachment handling. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a Saturday patch deadline for federal agencies. The bug affects AsyncOS releases with File Reputation enabled and Content Scanner Tools versions earlier than 25.3.0.5525; there is no workaround, only an upgrade to AsyncOS 16.5.0-780 or later. This marks the second SEG root-via-email zero-day in two months, following CVE-2026-76461 in September and a perfect-10 CVE-2025-20393 exploited in January. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-76519 and how does it affect Cisco Secure Email Gateway? CVE-2026-76519 is a critical vulnerability (CVSS 9.8) in Cisco Secure Email Gateway's Advanced Malware Protection feature that lets a remote, unauthenticated attacker send a malicious email attachment to write files and execute commands as root on the appliance. It affects both physical and virtual SEG appliances running vulnerable Cisco AsyncOS releases, and Cisco confirmed active zero-day exploitation before a patch was released. _Teams running Cisco SEG can track fast-moving zero-day disclosures like this one on daily.dev._ ### How do I know if my Cisco SEG appliance is vulnerable to CVE-2026-76519? An appliance is vulnerable if the File Reputation service, part of Cisco AMP, is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco's advisory includes steps to check both conditions. There is no workaround, so affected systems must be upgraded to a fixed AsyncOS release, such as 16.5.0-780 for versions earlier than 16.5. _Admins verifying exposure to this flaw can follow ongoing Cisco advisory coverage on daily.dev._ ### Has Cisco Secure Email Gateway had other root-access zero-days recently? Yes, CVE-2026-76519 is the second root-via-email zero-day in Secure Email Gateway within two months. In mid-September, Cisco warned of a similar flaw, CVE-2026-76461, also allowing a malicious email to grant root access, and in January attackers exploited another critical AsyncOS flaw, CVE-2025-20393, which scored a perfect 10 CVSS, to install persistence mechanisms. _Security teams tracking the pattern of repeated Cisco SEG exploits can follow updates on daily.dev._ ## Similar posts on daily.dev - [Cisco email security boxes can be rooted by... an email](https://daily.dev/posts/cisco-email-security-boxes-can-be-rooted-by-an-email-wpmicaznu) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cisco](https://daily.dev/tags/cisco), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco make-me-root email bug exploited as a 0-day by unknown crims","url":"https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj"},"datePublished":"2026-10-14T21:44:17.262Z","dateModified":"2026-10-15T12:55:35.818Z","description":"Cisco is urging customers to patch a critical, actively exploited zero-day (CVE-2026-76519, CVSS 9.8) in its Secure Email Gateway's Advanced Malware Protection...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/818a7a06c78453c2a053a9c7ae6d059d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/818a7a06c78453c2a053a9c7ae6d059d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cisco,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Cisco make-me-root email bug exploited as a 0-day by unknown crims"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims-asfryfvhj#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76519 and how does it affect Cisco Secure Email Gateway?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76519 is a critical vulnerability (CVSS 9.8) in Cisco Secure Email Gateway's Advanced Malware Protection feature that lets a remote, unauthenticated attacker send a malicious email attachment to write files and execute commands as root on the appliance. It affects both physical and virtual SEG appliances running vulnerable Cisco AsyncOS releases, and Cisco confirmed active zero-day exploitation before a patch was released. Teams running Cisco SEG can track fast-moving zero-day disclosures like this one on daily.dev."}},{"@type":"Question","name":"How do I know if my Cisco SEG appliance is vulnerable to CVE-2026-76519?","acceptedAnswer":{"@type":"Answer","text":"An appliance is vulnerable if the File Reputation service, part of Cisco AMP, is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco's advisory includes steps to check both conditions. There is no workaround, so affected systems must be upgraded to a fixed AsyncOS release, such as 16.5.0-780 for versions earlier than 16.5. Admins verifying exposure to this flaw can follow ongoing Cisco advisory coverage on daily.dev."}},{"@type":"Question","name":"Has Cisco Secure Email Gateway had other root-access zero-days recently?","acceptedAnswer":{"@type":"Answer","text":"Yes, CVE-2026-76519 is the second root-via-email zero-day in Secure Email Gateway within two months. In mid-September, Cisco warned of a similar flaw, CVE-2026-76461, also allowing a malicious email to grant root access, and in January attackers exploited another critical AsyncOS flaw, CVE-2025-20393, which scored a perfect 10 CVSS, to install persistence mechanisms. Security teams tracking the pattern of repeated Cisco SEG exploits can follow updates on daily.dev."}}]} ```