Cisco patches exploited email flaw enabling unauthenticated attackers to gain root access
Cisco has urged customers to patch a critical vulnerability in its Secure Email Gateway (SEG) after attackers exploited it before a fix was available. The flaw lets an unauthenticated attacker gain root access by sending an email with a malicious attachment, putting affected organisations’ email systems at risk.
Tracked as CVE-2026-76519, the bug has a CVSS score of 9.8 and affects physical and virtual appliances running vulnerable AsyncOS releases when specific AMP settings and an outdated Content Scanner Tools version are in use. Cisco says a limited number of customers are affected; CISA added the flaw to its Known Exploited Vulnerabilities catalogue and set federal agencies a Saturday deadline to patch. There is no workaround, and Cisco recommends upgrading to a fixed release, including version 16.5.0-780 for releases earlier than 16.5. This is the second SEG zero-day disclosed in as many months.
- Attackers are exploiting a critical Cisco SEG email vulnerability.
- A malicious attachment can enable unauthenticated root access.
- Cisco says customers must upgrade; there is no workaround.
New here? Start with this
Cisco Secure Email Gateway is a product organisations use to filter and manage incoming email. It runs on Cisco’s AsyncOS software, and some configurations also use tools that scan email attachments for malware.
A software flaw can let an attacker exploit a system, while “root access” means having the highest level of control over it. In this case, the reported risk concerns certain gateway versions and configurations, rather than every Cisco email system.
Email gateways sit between the internet and an organisation’s inboxes, so a breach could put systems and messages at risk. Cisco makes the product and issues software fixes; CISA, the US government’s cybersecurity agency, tracks vulnerabilities known to be exploited and sets deadlines for federal agencies to address them.
Read the full article at the source →
Originally published by The Register as “Cisco make-me-root email bug exploited as a 0-day by unknown crims”.