{"id":61545,"date":"2026-10-14T21:40:29","date_gmt":"2026-10-14T21:40:29","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5303168"},"modified":"2026-10-14T21:40:29","modified_gmt":"2026-10-14T21:40:29","slug":"cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims\/","title":{"rendered":"Cisco make-me-root email bug exploited as a 0-day by unknown crims"},"content":{"rendered":"
<\/div>\n
<\/p>\n

security <\/p>\n

<\/a> <\/p>\n

Both Switchzilla and CISA sound the alarm <\/p>\n<\/p><\/div>\n

<\/p>\n

Cisco \u201cstrongly\u201d implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register<\/span> that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects \u201ca limited number of customers.\u201d <\/p>\n

The bug, now tracked as CVE\u20112026\u201176519<\/a>, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance\u2019s operating system – simply by sending a malicious email. In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. <\/p>\n

The US Cybersecurity and Infrastructure Security Agency (CISA) a<\/a>dded the vulnerability<\/a> to its Known Exploited Vulnerabilities catalog<\/a>, and set a Saturday deadline for federal agencies to fix the issue. <\/p>\n

\u201cWe are aware of active exploitation of this vulnerability,\u201d the spokesperson said, but declined to answer our questions about how many appliances had been compromised, and what attackers were doing with this access after exploiting the bug. <\/p>\n

\u201cWe strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory,\u201d  the spokesperson said.<\/p>\n

The flaw exists in SEG\u2019s Advanced Malware Protection (AMP) feature, and it\u2019s due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment<\/a>, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance.<\/p>\n

This vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met:<\/p>\n