AI analysis
Claude Opus · 5 Nov 2026, 10:21 CET
Cisco Secure Email Gateway flaw lets crafted email attachments gain root access
An exploited path traversal flaw in the AMP feature of Cisco Secure Email Gateway (AsyncOS 15.x and 16.x) lets an unauthenticated attacker write files and run root commands by emailing a crafted attachment. Apply Cisco's guidance immediately.
In plain terms
Cisco Secure Email Gateway is an appliance that sits in front of an organisation's mail system and filters incoming email for spam and malware. One of its features, Advanced Malware Protection (AMP), checks attachments against a file reputation service, which is a lookup that judges whether a file is known to be malicious. When that service is enabled, the gateway mishandles certain attachments. An attacker only needs to send an email with a specially crafted attachment through the device to write files anywhere on its underlying operating system and run commands with root privileges. Root is the highest level of control on the system.
The attacker needs no account and no help from any user. Sending an email is enough, so any organisation running an affected gateway with this feature enabled should treat it as urgent. CISA has confirmed the flaw is being exploited in real attacks.