Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco says attackers are exploiting an unauthenticated root zero-day in Secure Email Gateway.
Cisco PSIRT said attackers were actively exploiting a zero-day in the AMP File Reputation feature of Cisco Secure Email Gateway in October 2026, tracked as advisory cisco-sa-esa-afw-zqYJkjxp. An unauthenticated attacker can send a crafted email attachment to write arbitrary files and run commands as root; the supplied text includes no CVE or CVSS score. Appliances are affected when File Reputation is enabled on a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. The fix is Content Scanner Tools 25.3.0.5525 or later, with no workaround; Secure Email and Web Manager and Secure Web Appliance are not vulnerable.
- Unauthenticated crafted attachment yields root file write and command execution.
- File Reputation must be enabled and the scanner older than 25.3.0.5525.
- No workaround; the scanner update needs no AsyncOS upgrade or reboot.
- Secure Email Cloud customers already received the fixed package.
- Compromised cluster members may expose SSH keys used between nodes.
Full article635 words · extracted from gbhackers.com · click to collapse
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway.
An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in October 2026.
I could not retrieve the advisory page, so this article relies on the advisory text you supplied. It has no CVE ID or CVSS score, so add them once Cisco publishes them.
Cisco email gateway zero-day
The flaw comes from improper handling of email attachments when the File Reputation service is enabled. An attacker sends an email with a crafted attachment through a vulnerable gateway.
No authentication or user interaction is needed. A successful exploit gives the attacker arbitrary file write and command execution with root privileges.
Both physical and virtual Cisco Secure Email Gateway appliances are affected when both of these conditions hold: the File Reputation service, part of Cisco AMP, is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco confirmed that Secure Email and Web Manager and Secure Web Appliance are not vulnerable. Administrators can check File Reputation in the web interface. They go to Mail Policies > Incoming or Outgoing Mail Policies > Advanced Malware Protection and look for the “Enable File Reputation” check box on a policy. They can check the scanner version with the contentscannerstatus CLI command. Version 25.2.0.5427.15.5.001 is vulnerable.
Root access lets attackers delete or hide evidence, so a clean result is not proof of safety. Cisco urges teams to cross-check network and firewall logs outside the device.
They should look for unexpected uploads from the appliance to external IP addresses and for downloads from malicious IPs.
Secure Email Cloud administrators without CLI access may not be able to check these indicators themselves. Cisco has directly contacted cloud customers where it detected malicious activity.
According to the advisory published by Cisco, no workarounds exist. The fix ships in Content Scanner Tools 25.3.0.5525 and later, and it reaches all licensed and supported AsyncOS releases. Installing it needs no software upgrade or restart.
| AsyncOS release | First fixed release |
| 15.5 | 15.5.5-014 |
| 16.0 | Migrate to a fixed release |
| 16.5 | 16.5.0-780 |
Cisco recommends that customers on releases earlier than 16.5 migrate to 16.5.0-780. Customers with automatic updates enabled need to do nothing once the update applies. Others should run contentscannerupdate at the CLI.
To turn on automatic updates, go to Security Services > Service Updates > Edit Update Settings. Then select Automatic Updates, submit, and commit the changes. Secure Email Cloud Gateway customers need no action, because Cisco has already deployed the fixed package.
For a suspected compromise on a physical appliance, contact Cisco TAC and enable remote access to speed the investigation.
For a virtual appliance, Cisco recommends preserving forensic data first because upgrading a compromised instance destroys logs, deploying a new virtual machine on a fixed release, rebuilding the configuration without importing old configuration files, renewing all credentials and cryptographic material, and continuing to monitor for anomalous behavior.
Cluster members authenticate to each other with SSH key pairs. An attacker could steal the private keys from one compromised appliance and use them to take over other members. Cisco therefore recommends restoring every member of a cluster that contains at least one compromised appliance.
Cisco also recommends general hardening measures, including blocking internet access to the appliance or limiting it to trusted hosts, putting mail and management traffic on separate network interfaces, disabling HTTP and FTP, sending logs to an external server, using SAML or LDAP authentication, and changing the default administrator password.
Cisco has also published a September 2026 Security Hardening Release for Secure Email Gateway and Secure Email and Web Manager.