Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
cisco-sa-notice-QGwHnJ6k
Summary
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
For further documentation of improvements and fixes in Cisco Secure Email Gateway, see Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026.
Products covered
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
Remediation
There are no workarounds that address this vulnerability.
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Fixed Releases
In the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
Cisco AsyncOS Software for Cisco Secure Email Gateway Release | First Fixed Release |
|---|---|
15.5 | 15.5.5-014 |
16.0 | Migrate to a fixed release. |
16.5 | 16.5.0-780 |
Cisco strongly recommends that customers who are running Cisco AsyncOS Software releases earlier than Release 16.5 migrate to Release 16.5.0-780.
The fix for this vulnerability is also distributed to all licensed and supported Cisco AsyncOS Software releases through an updated version of the Content Scanner Tools package. Content Scanner Tools versions 25.3.0.5525 and later contain the fix for this vulnerability.
Update the Content Scanner Tools
Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied. Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.
Manual Update
To manually update the Content Scanner Tools, use the command contentscannerupdate at the CLI, as shown in the following example:
cisco-esa> contentscannerupdate Requesting check for new Content Scanner updates.
For instructions on how to verify the current version, see the Vulnerable Products section of this advisory.
Automatic Update
To enable automatic updates, complete the following steps on the web-based management interface:
Choose Security Services > Service Updates.
Click Edit Update Settings.
Click the Automatic Updates check box.
Click Submit.
Choose Commit Changes on the top right of the page.
Click Commit Changes to confirm the uncommitted changes.
For customers who use Cisco Secure Email Cloud Gateway, no action is required. Cisco has taken actions to protect the infrastructure from this vulnerability, and a fixed version of Content Scanner Tools is already deployed as part of the standard upgrade processes for the environment.
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
CVEs in this advisory 1
Updates
- Published by Cisco
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.