Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco says attackers are exploiting an unauthenticated root zero-day in Secure Email Gateway.
Cisco PSIRT said attackers were actively exploiting a zero-day in the AMP File Reputation feature of Cisco Secure Email Gateway in October 2026, tracked as advisory cisco-sa-esa-afw-zqYJkjxp. An unauthenticated attacker can send a crafted email attachment to write arbitrary files and run commands as root; the supplied text includes no CVE or CVSS score. Appliances are affected when File Reputation is enabled on a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. The fix is Content Scanner Tools 25.3.0.5525 or later, with no workaround; Secure Email and Web Manager and Secure Web Appliance are not vulnerable.
86