Description
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Secure Email | 14.0.0-698, 13.5.1-277, 13.0.0-392, 14.2.0-620, 13.0.5-007, 13.5.4-038, 14.2.1-020, 14.3.0-032, 15.0.0-104, 15.0.1-030, 15.5.0-048, 15.5.1-055, 15.5.2-018, 16.0.0-050, 15.0.3-002, 16.0.0-054, 15.5.3-022, 16.0.1-017, 15.5.4-012, 16.0.4-016, 15.0.5-016, 16.0.2-112, 16.0.3-044 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Cisco Secure Email Gateway AMP Arbitrary File Write RCE
exploit/unix/smtp/cisco_secure_email_gateway_amp_file_write_rce
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2026-3963 Cisco Secure Email Gateway: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 14, 2026
- NCSC-2026-0429 Kwetsbaarheid verholpen in Cisco Secure Email Gateway NCSC-NL (Netherlands) · Oct 14, 2026