Cisco has warned that attackers are actively exploiting a zero-day flaw within the Superior Malware Safety (AMP) function of Cisco Safe E-mail Gateway.
An unauthenticated distant attacker can use it to put in writing arbitrary information and run instructions as root on the underlying working system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT realized of lively exploitation in October 2026.
I couldn’t retrieve the advisory web page, so this text depends on the advisory textual content you provided. It has no CVE ID or CVSS rating, so add them as soon as Cisco publishes them.
Cisco electronic mail gateway zero-day
The flaw comes from improper dealing with of electronic mail attachments when the File Status service is enabled. An attacker sends an electronic mail with a crafted attachment by means of a susceptible gateway.
No authentication or person interplay is required. A profitable exploit provides the attacker arbitrary file write and command execution with root privileges.
Each bodily and digital Cisco Safe E-mail Gateway home equipment are affected when each of those circumstances maintain: the File Status service, a part of Cisco AMP, is enabled and assigned to a mail coverage, and the Content material Scanner Instruments model is sooner than 25.3.0.5525.
Cisco confirmed that Safe E-mail and Net Supervisor and Safe Net Equipment usually are not susceptible. Directors can examine File Status within the net interface. They go to Mail Insurance policies > Incoming or Outgoing Mail Insurance policies > Superior Malware Safety and search for the “Allow File Status” examine field on a coverage. They will examine the scanner model with the contentscannerstatus CLI command. Model 25.2.0.5427.15.5.001 is susceptible.
Root entry lets attackers delete or cover proof, so a clear consequence just isn’t proof of security. Cisco urges groups to cross-check community and firewall logs exterior the gadget.
They need to search for sudden uploads from the equipment to exterior IP addresses and for downloads from malicious IPs.
Safe E-mail Cloud directors with out CLI entry could not have the ability to examine these indicators themselves. Cisco has instantly contacted cloud clients the place it detected malicious exercise.
In accordance with the advisory printed by Cisco, no workarounds exist. The repair ships in Content material Scanner Instruments 25.3.0.5525 and later, and it reaches all licensed and supported AsyncOS releases. Putting in it wants no software program improve or restart.
| AsyncOS launch | First fastened launch |
| 15.5 | 15.5.5-014 |
| 16.0 | Migrate to a hard and fast launch |
| 16.5 | 16.5.0-780 |
Cisco recommends that clients on releases sooner than 16.5 migrate to 16.5.0-780. Clients with automated updates enabled have to do nothing as soon as the replace applies. Others ought to run contentscannerupdate on the CLI.
To activate automated updates, go to Safety Providers > Service Updates > Edit Replace Settings. Then choose Computerized Updates, submit, and commit the adjustments. Safe E-mail Cloud Gateway clients want no motion, as a result of Cisco has already deployed the fastened bundle.
For a suspected compromise on a bodily equipment, contact Cisco TAC and allow distant entry to hurry the investigation.
For a digital equipment, Cisco recommends preserving forensic information first as a result of upgrading a compromised occasion destroys logs, deploying a brand new digital machine on a hard and fast launch, rebuilding the configuration with out importing previous configuration information, renewing all credentials and cryptographic materials, and persevering with to watch for anomalous habits.
Cluster members authenticate to one another with SSH key pairs. An attacker might steal the non-public keys from one compromised equipment and use them to take over different members. Cisco due to this fact recommends restoring each member of a cluster that comprises a minimum of one compromised equipment.
Cisco additionally recommends common hardening measures, together with blocking web entry to the equipment or limiting it to trusted hosts, placing mail and administration visitors on separate community interfaces, disabling HTTP and FTP, sending logs to an exterior server, utilizing SAML or LDAP authentication, and altering the default administrator password.
Cisco has additionally printed a September 2026 Safety Hardening Launch for Safe E-mail Gateway and Safe E-mail and Net Supervisor.
