Cisco said in a security advisory that a flaw in Secure Email Gateway lets an attacker without a login take over the device. The attacker sends an email with a crafted attachment through the gateway. This can let them write files and run commands as root, the highest level of access. The flaw is in the Advanced Malware Protection feature and only matters when the file reputation service is on. Cisco said its security team learned of active attacks in October 2026. It said it found the flaw during internal security scanning. Cisco has released fixes, and says no workaround exists.
Cisco did not say how many devices were hit, who is behind the attacks, or when they began. It said it contacted Secure Email Cloud customers where it saw signs of compromise, and that it is working on recovery. Cisco warned that attackers with root access may erase traces of their work, so logs on the device may not tell the full story. It also said stolen private SSH keys, used for trust between clustered devices, could let attackers reach other members of a cluster.
The flaw affects physical and virtual gateways with file reputation on and Content Scanner Tools older than version 25.3.0.5525. Cisco says updating that package needs no restart. Cisco says cloud customers need to do nothing. Teams that run their own gateways should check their version, update, and review network and firewall logs outside the device. Cisco advises restoring every member of a cluster if any one is compromised.