- Cisco says attackers are exploiting a flaw in its Secure Email Gateway. A crafted attachment from a sender with no login could let them run commands as root.
- Cisco says only gateways on a vulnerable AsyncOS release, with File Reputation on and Content Scanner Tools older than 25.3.0.5525, are affected. It lists no workaround.
- Check the scanner version with contentscannerstatus, update it, and review logs held outside the device. A clean on-device result is not proof of safety.
The guard reads the mail, and the mail reaches the guard
An email gateway opens risky things so that staff do not have to. That is also its weakness. To do the job, it must handle every attachment that anyone online chooses to send.
Cisco now says attackers are using that exposure. The flaw sits in the Advanced Malware Protection feature of Cisco Secure Email Gateway. A stranger with no login could plant files of their choosing on the device's operating system. Cisco says a successful attack could also run commands as root, which means full control of the device.
The lesson is that a security product sits in an exposed position by design. Its quality is a business risk, not only a technical one. When it fails, the attacker lands on a machine that already sees an organisation's mail.
How the attack works
Cisco traces the flaw to how the gateway treats attachments when its file reputation check is on. That check asks whether a file is already known to be bad. The attacker needs no account. They only send an email with a crafted attachment through a vulnerable gateway.
Three things must be true at once. The gateway must run a vulnerable AsyncOS release. The reputation check must be switched on and tied to a mail policy. And the scanner package, called Content Scanner Tools, must be older than 25.3.0.5525.
Cisco says physical and virtual gateways can both be hit. Two related products are not affected by this flaw, according to Cisco: Secure Email and Web Manager, and Secure Web Appliance.
Cisco says its own internal scanning found the flaw. Its incident response team learned of attacks in October 2026.
The fix is a version number, not a project
The detail that matters most to leaders is how the fix arrives. Cisco says it reaches all licensed and supported AsyncOS releases through a newer scanner package, version 25.3.0.5525 or later. Installing it needs no software upgrade and no restart.
That makes the fix quick. It also makes it easy to assume. Cisco says that if automatic updates are on, nobody has to do anything once the update lands. The Hacker News advises teams to confirm the version with the contentscannerstatus command. Do not assume the update arrived.
Cisco's sample output for a vulnerable gateway shows a 25.2 version, 25.2.0.5427.15.5.001, with a last-updated status of "Never updated".
The Hacker News says Cisco shipped full AsyncOS fixes on September 14 as part of a hardening release. The fixed builds are 15.5.5-014 and 16.5.0-780. Cisco now says that release covered this flaw.
So a fix existed before the attacks were known. Whether a given gateway received it is a separate question.
What the advisory leaves open
The Hacker News points to three gaps. The advisory gives no count of attacked devices. It does not name who is behind the attacks. And it does not say whether any attacker reached root. Treat all three as unknown.
Older builds have a gap too. The same outlet says a 16.0 gateway on build 16.0.4-302 is not fixed for this flaw. That build fixed a separate September issue. For teams that stay on 16.0, the scanner check is the only way the advisory lets them confirm a fix.
Cisco lists no workaround. It also warns that an attacker with root may hide traces. So a clean result on the device proves little.
Cisco urges teams to look at network and firewall logs held elsewhere. The signs to look for are uploads from the gateway to outside addresses, or downloads from malicious ones.
Clusters add a second risk. Cisco says the private SSH keys that cluster members use to trust each other could be taken from a compromised unit. That may open the door to the other members. So Cisco says to restore every member of a cluster when even one is compromised.
What to ask your team this week
Start with inventory. Which email gateways do we run: physical, virtual or managed? Cisco says Secure Email Cloud Gateway customers need no action. It also says it has contacted managed customers whose devices showed signs of possible compromise.
Then ask for evidence, not reassurance. What does contentscannerstatus show on each gateway? Is File Reputation on for any mail policy? Are automatic updates on? Does any gateway still run 16.0?
Ask about forensics before anyone upgrades. Cisco warns that upgrading a compromised virtual instance destroys forensic data and logs. Its steps are to record forensic information first. Then deploy a new virtual machine on a fixed release. Rebuild the configuration without importing old files. Renew credentials and cryptographic material.
Finally, ask whether anyone watches outbound traffic from the gateway itself. A tool that guards the door deserves its own watcher. The gateway protects the mail, and someone still has to protect the gateway.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cisco.
