Critical RCE Vulnerability in Cisco Secure Email Gateway

On 14 October 2026, Cisco disclosed a critical vulnerability (CVE-2026-017) affecting the Advanced Malware Protection (AMP) feature within Cisco Secure Email Gateway. The vulnerability allows an unauthenticated, remote attacker to perform arbitrary file writes and execute commands as the root user on the underlying operating system. The Cisco PSIRT has confirmed that this vulnerability is currently being actively exploited in the wild. This represents a significant risk as it grants attackers full control over the appliance, which is typically positioned at the network perimeter. Given the active exploitation, immediate remediation is required for all internet-facing appliances.

Impact

Successful exploitation results in full system compromise with root-level privileges. Attackers can gain persistent access to the email gateway, intercept or manipulate sensitive internal and external email traffic, and use the appliance as a pivot point for further lateral movement into the internal network. The scope of targeting includes all organizations utilizing Cisco Secure Email Gateway with the AMP feature enabled, particularly those with management or scanning interfaces reachable via the internet.

Recommendation

• Prioritize patching for all Cisco Secure Email Gateway appliances exposed to the internet.
• Update the Content Scanner Tools package or upgrade Cisco AsyncOS Software to a release containing the fix for CVE-2026-017.
• Conduct forensic analysis on affected appliances to identify indicators of unauthorized access or malicious file artifacts resulting from the arbitrary file write capability.
• Review peripheral network access controls to restrict exposure of the Secure Email Gateway management interface.