A critical Cisco Secure Email Gateway vulnerability lets attackers abuse crafted attachments to write files and run commands as root, even if no one opens the email. GajIPS detects the attack traffic
Severity: Critical | Priority: 1
Cisco Secure Email Gateway has a relative path traversal flaw in its Advanced Malware Protection (AMP) feature. An unauthenticated attacker can exploit it by sending an email with a crafted attachment through the gateway. The attacker can then write arbitrary files and run commands as root, and no user needs to open the attachment. A gateway is exposed only when both of these are true:
Cisco has confirmed active exploitation since October 2026, and the flaw carries a CVSS score of 9.8.
If this alert is raised, check whether the destination is a Cisco Secure Email Gateway on your network. If it is, run contentscannerstatus at the gateway CLI to confirm the Content Scanner Tools version, and check whether File Reputation is enabled in your inbound or outbound mail policies. Then run Cisco’s compromise check, grep "System Security" system_logs, on every member of the cluster. It reports whether a suspected compromise indicator was found, whether the scan did not complete, or whether nothing was found. Contact Cisco TAC for either of the first two results.