> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Cisco make-me-root email bug exploited as a 0-day by unknown crims - URL: https://f4n6.co.uk/security-feed/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/ - Published: 2026-10-15T11:45:25.000Z - Updated: 2026-10-15T11:45:25.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-76519, CVE-2026-76461, CVE-2025-20393 ## 1\. Executive summary Cisco Secure Email Gateway (SEG) is being exploited as a zero-day through CVE-2026-76519, a CVSS 9.8 critical flaw in the Advanced Malware Protection (AMP) File Reputation feature that lets an unauthenticated remote sender write files and execute commands as root on the appliance by sending a crafted email attachment. CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities catalog on 2026-10-14, and Cisco states exploitation is active against a limited number of customers. This is the third exploited root-level SEG flaw in ten months: CVE-2026-76461 (CVSS 9.8, KEV added 2026-09-14, EPSS 30%) in September and CVE-2025-20393 (CVSS 10.0, KEV added 2025-12-17, EPSS 32%) in January. For EMEA financial services, the exposure is concentrated in firms running on-premises or virtual SEG appliances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525; the appliance sits inline on inbound mail, so the attack path requires no credentials, no user interaction and no administrative interface access. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Active exploitation of an internet-facing email security appliance that grants root on the operating system, with Cisco unable to confirm how many appliances are compromised or what attackers did post-exploitation. | Firms running affected SEG appliances must run the incident management process against possible compromise, not just against the patch: log review, forensic preservation, and a decision on appliance rebuild where indicators are ambiguous. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A confirmed root-level compromise of an email gateway is a candidate major incident, and Cisco's own guidance notes attackers can tamper with logs, so detection may only surface after the reporting clock has started. | Where compromise is confirmed, the classification and reporting timeline under Art. 18 and Art. 19 starts from awareness, not from the point the appliance is rebuilt. | | NIS2 Art. 21(2)(d): supply chain security measures | The exploited component is a vendor-supplied email security product, and the fix depends on a vendor software release (AsyncOS 16.5.0-780) with no workaround available. | Supply chain measures must cover the vendor patch intake path for an inline security control, including how quickly a no-workaround vendor fix is deployed outside normal cycles. | ## 3\. Technical analysis & attack chain CVE-2026-76519 is a critical (CVSS 9.8) remote code execution flaw in Cisco Secure Email Gateway's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. The verified reference data classifies it as CWE-23 (relative path traversal); Cisco's advisory describes the mechanism as improper attachment handling, and both descriptions are consistent with a file-write primitive that escapes its intended directory. The verified data records CISA KEV addition on 2026-10-14\. No CISA remediation due date is given in the verified reference data for this CVE. Confirmed attack chain: 1. The attacker sends an email carrying a crafted attachment to an address routed through a vulnerable SEG appliance. No authentication and no access to the management interface are required. 2. The appliance processes the attachment through the AMP File Reputation path. Exploitation requires two preconditions on the target: the File Reputation service (part of Cisco AMP) is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. 3. Successful exploitation lets the attacker write files to the appliance operating system and execute commands with root privileges. 4. Cisco states it became aware of active exploitation in October 2026\. The company has not disclosed how many appliances were compromised or what attackers did with the access. Affected scope, per Cisco: physical and virtual SEG appliances running a vulnerable Cisco AsyncOS Software release, where both preconditions above are met. Cisco's advisory documents how to check whether File Reputation is enabled and which Content Scanner Tools version is installed. There are no workarounds. Cisco recommends customers on AsyncOS releases earlier than 16.5 migrate to 16.5.0-780. The two prior SEG compromises give the operational picture Cisco has not supplied for this one. CVE-2026-76461, disclosed 2026-09-14, is a SQL injection flaw (CWE-89 per the verified reference data) in AsyncOS email parsing that also yields unauthenticated root command execution; Rapid7 notes it was added to KEV the same day Cisco disclosed it, indicating zero-day exploitation before disclosure, and that no public proof-of-concept and no attribution existed at publication. Cisco's detection guidance for that bug was to grep `mail_logs` for suspicious SQL statements, specifically `COPY.*TO PROGRAM`, on every node of a cluster. CVE-2025-20393, CVSS 10.0 and CWE-20 (improper input validation) per the verified reference data, was exploited in January 2026 to break into SEG appliances and install persistence mechanisms. Two caveats. First, the CVE-2026-76519 detail above rests on Cisco's advisory as relayed by The Register and The Hacker News; Cisco has declined to answer questions on compromise counts and post-exploitation activity, so the impact picture is incomplete by the vendor's own choice. Second, no actor has been named or attributed by Cisco, CISA or any source in this set. The Register's headline calls them "unknown crims"; that is a description, not an attribution. There is no MITRE ATT&CK profile for any actor in the verified reference data, so attribution is unconfirmed and should be treated as such in any internal reporting. ## 4\. Mitigation & containment P1 (within 24 hours) - Determine whether each SEG appliance is in scope. In scope means both conditions are true: File Reputation (Cisco AMP) is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525\. Cisco's advisory gives the commands to check both; run them on every appliance, not a sample. - Upgrade in-scope appliances to a fixed AsyncOS release. Cisco recommends 16.5.0-780 and states there are no workarounds. Treat this as an emergency change outside the normal patch cycle. - Where an appliance shows any sign of compromise, do not trust its own logs. Cisco's guidance for the September SEG bug applies to the same class of root-level access: attackers with root can tamper with logs and cover their tracks, so check network and firewall logs held outside the appliance for unexpected uploads or downloads. - For virtual appliances suspected of compromise, follow Cisco's recovery sequence: preserve forensic evidence, deploy a fresh VM running fixed software, rebuild the configuration, and rotate credentials and cryptographic material. P2 (within 72 hours) - Hunt across mail logs for the exploitation pattern Cisco published for the September SEG bug, which shares the same root-access outcome: `cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]`. Any hit warrants escalation. Run it on each cluster device. - Review outbound network and firewall logs for traffic from SEG management or data interfaces to unexpected destinations, since the appliance itself may be unreliable as an evidence source. - Confirm the patch state of any SEG appliance still running AsyncOS earlier than 16.5, and of any appliance that was in scope for CVE-2026-76461 or CVE-2025-20393 and has not been rebuilt since. P3 (within 7 days) - Reduce the exposed attack surface: restrict management and control-plane access to SEG appliances to known administrative networks, and confirm no SEG management interface is reachable from the internet. - Review whether File Reputation needs to be enabled and assigned to a mail policy on every appliance where it currently is. This is a functional control, not a workaround, so the decision is a risk trade-off for the mail security team, not a fix. - Fold the SEG patch intake path into the supply chain measures under NIS2 Art. 21(2)(d), given three exploited root-level SEG flaws in ten months and a vendor fix with no workaround. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe observable behaviours and one log-based detection pattern. | type | value | confidence | source | | ----------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | --------------------------------------- | | log pattern | COPY.\*TO PROGRAM in IronPort Text Mail Logs (default: mail\_logs) | medium (published by Cisco for CVE-2026-76461, same root-access outcome) | Rapid7, citing Cisco advisory | | behavioural | crafted email attachment processed by AMP File Reputation leading to file write or command execution as root | medium | Cisco via The Register, The Hacker News | Behavioural indicators: | behaviour | where to observe | confidence | | -------------------------------------------------------------- | ----------------------------------------------------------- | --------------------------------------------------------------- | | Suspicious SQL statements in mail processing logs | IronPort Text Mail Logs (mail\_logs) on each cluster device | medium (Cisco guidance for CVE-2026-76461) | | Unexpected uploads or downloads from the appliance | Network and firewall logs held outside the SEG appliance | medium (Cisco guidance, since root access allows log tampering) | | File write or root command execution triggered by inbound mail | SEG appliance OS-level telemetry, if collected off-box | low (no atomic detail published for CVE-2026-76519) | ```iocs log_pattern COPY.*TO PROGRAM ``` ## 6\. Detection The sources give one usable artefact: the `COPY.*TO PROGRAM` log pattern Cisco published for the September SEG bug. It is a log string, not a file artefact, so it belongs in a Sigma rule rather than YARA. No file hashes, filenames, mutexes, registry keys or command-line flags for CVE-2026-76519 appear in the source material, so no YARA rule is emitted. ```yaml title: Cisco Secure Email Gateway suspicious SQL COPY TO PROGRAM in mail logs id: 8f3c1a72-4d5e-4b91-9c07-2a6e5f0d1b84 status: experimental description: Detects the log pattern Cisco published for CVE-2026-76461, a root-level SEG flaw exploited via crafted email. The same pattern is a candidate indicator for CVE-2026-76519 given the shared root-access outcome. author: Adverse Trace date: 2026-10-15 references: - https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild - https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168 logsource: product: cisco service: secure_email_gateway detection: keywords: - 'COPY.*TO PROGRAM' condition: keywords falsepositives: - Legitimate administrative SQL operations on the appliance level: high ``` ## CVE assessment 3 referenced CVEs — **3 actively exploited (CISA KEV)**, 3 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-20393](https://nvd.nist.gov/vuln/detail/CVE-2025-20393?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2025-12-17 | 32% | A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email… | | [CVE-2026-76519](https://nvd.nist.gov/vuln/detail/CVE-2026-76519?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-10-14 | — | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated,… | | [CVE-2026-76461](https://nvd.nist.gov/vuln/detail/CVE-2026-76461?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-09-14 | 30% | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, r… | ## 7\. Sources - The Register, "Cisco make-me-root email bug exploited as a 0-day by unknown crims", https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168, 2026-10-14 - The Register, "Cisco email security boxes can be rooted by... an email", https://www.theregister.com/security/2026/09/15/cisco-email-security-boxes-can-be-rooted-by-an-email/5296604, 2026-09-15 - The Hacker News, "Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability", https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html - The Hacker News, "Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution", https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html - Rapid7, "CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild", https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild, 2026-09-15 - CISA Known Exploited Vulnerabilities, CVE-2026-76461, https://nvd.nist.gov/vuln/detail/CVE-2026-76461 - The Register, "Cisco drops another exploited zero-day, this time a perfect 10", https://www.theregister.com/security/2026/09/17/cisco-drops-another-exploited-zero-day-this-time-a-perfect-10/5297180, 2026-09-17 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-76519 as high urgency for any EMEA financial services client running on-premises or virtual Cisco SEG with AMP File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525\. The verified severity is CVSS 9.8 critical, the CVE is in CISA KEV as of 2026-10-14, and exploitation is confirmed by the vendor. The absence of a workaround and the inline position of the appliance on inbound mail mean the only effective control is the vendor fix, and the September and January precedents show that root access on this appliance class is used to install persistence and to tamper with logs, so a clean log review is not evidence of a clean appliance. Attribution is unconfirmed: no source in this set names an actor, and the verified reference data contains no MITRE ATT&CK profile for any actor associated with this activity, so we are not attributing it. The CVE-2026-76519 technical detail is single-sourced to Cisco via The Register and The Hacker News; the `COPY.*TO PROGRAM` detection pattern is single-sourced to Cisco via Rapid7 and was published for CVE-2026-76461, not CVE-2026-76519, so verify before enforcement. We will track Cisco's advisory for post-exploitation detail and any revision to the affected Content Scanner Tools threshold, and we will issue a follow-up if Cisco publishes indicators for CVE-2026-76519 specifically. --- [Read the original source →](https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*