Critical Vulnerability in Cisco Secure Email Gateway Under Active Exploitation

# Critical Vulnerability in Cisco Secure Email Gateway Under Active Exploitation

https://gcdradar.vercel.app/incidents/critical-vulnerability-in-cisco-secure-email-gateway-under-a · AIR-2026-1557 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed active exploitation in the wild.
- Fix status: Patched
- First reported: 2026-10-27 (happened 2026-10-14)
- AI role: No AI role
- Products: Cisco Secure Email Gateway

## Summary

Cisco published an advisory for a critical vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway. The flaw allows unauthenticated attackers to execute arbitrary commands with root privileges and is actively exploited.

## What to do

Update the Content Scanner Tools package or upgrade Cisco AsyncOS Software to a fixed release.

## Affected and fixed versions

- Affected: Cisco Secure Email Gateway
- Affected: Cisco AsyncOS Software

## Latest updates

- 2026-10-27: 2026-017: Critical Vulnerability in Cisco Secure Email Gateway (https://cert.europa.eu/publications/security-advisories/2026-017)

## Sources

- 2026-10-27 CERT-EU: 2026-017: Critical Vulnerability in Cisco Secure Email Gateway https://cert.europa.eu/publications/security-advisories/2026-017
- 2026-11-03 Cisco: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Email+Gateway+SQL+Injection+Vulnerability%26vs_k%3D1

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.