Cisco Secure Email Gateway Vulnerability: What MSPs Need to Know

What Happened

A critical Cisco Secure Email Gateway vulnerability is under active exploitation. On 14 October 2026, Cisco published a security advisory addressing the Advanced Malware Protection (AMP) feature of the product. CERT-EU followed with its own security advisory, 2026-017, warning that an unauthenticated, remote attacker can exploit this issue to write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco PSIRT is aware of active exploitation.

For MSPs, this is the kind of advisory that needs to move fast. Email gateways sit at the edge of your clients' networks. A root-level compromise on that appliance can give an attacker access to mail flow, domain credentials, and whatever else the gateway can reach. The advisory is light on version details, which makes inventory and patch verification the first job.

Timeline

• 14 October 2026: Cisco published a security advisory addressing a critical vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway.

Who Is Affected

The vulnerability affects the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. If you or your clients run this appliance, you should assume the affected feature is in scope until you confirm otherwise. The CERT-EU advisory specifically calls out appliances reachable from the internet as the ones to prioritise.

For MSPs, that means two groups matter: clients with a Cisco Secure Email Gateway in their own environment, and any shared or multi-tenant gateway you operate on their behalf. The risk is not limited to one vertical or company size, so treat every affected appliance as exposed until it is patched or verified clean.

Technical Details

CERT-EU advisory 2026-017 describes the issue as a critical vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. No CVE identifier is listed in the CERT-EU advisory, and no specific affected software versions or fixed release numbers are named there. The attack vector is remote and unauthenticated: an attacker can exploit the flaw to write arbitrary files and execute commands with root privileges on the underlying operating system.

The only mitigation path named by CERT-EU is to update the Content Scanner Tools package or upgrade Cisco AsyncOS Software to a fixed release. Because the advisory does not give a version list, you will need to check Cisco's own security advisory and your current AsyncOS release to determine whether you are on a fixed build.

Cisco Secure Email Gateway Vulnerability: What This Means for MSPs

This Cisco Secure Email Gateway vulnerability matters more than the average patch because of what the appliance does. The email gateway inspects inbound and outbound mail, strips malicious attachments, and handles content scanning through AMP. An attacker with root control of that device can tamper with the scanning engine, read mail queued on the box, and use the appliance's position to move laterally into the internal network.

For MSPs, the practical effect is that a compromised gateway can undermine the security promises you make to clients. The remediation is not just a patch, it is also a compromise assessment. Treat the appliance as a sensitive control point, and make sure your clients understand why this advisory is different from a routine software update.

What to Do This Week

1. Update the Content Scanner Tools package on every Cisco Secure Email Gateway you manage, or upgrade Cisco AsyncOS Software to a fixed release as soon as possible.
2. Prioritise appliances reachable from the internet. Those are the ones an external attacker can reach directly, so patch or mitigate them first.
3. Check all affected appliances for indicators of compromise. Pull logs, look for unexpected file writes, and review administrative access before and after the patch window.
4. As a standing practice, verify your AsyncOS version against Cisco's security advisory before you open a change window. The CERT-EU advisory does not list fixed releases, so Cisco's own documentation is the source of truth for versions.
5. If you have not already, confirm that outbound management access to the gateway is locked down. Restrict administrative interfaces to trusted IPs and require multi-factor authentication where the appliance supports it.
6. Review your monitoring and alerting for these appliances. An active exploit means you want to know about unusual process execution, file system changes, or outbound connections.

What to Tell Clients

Short version for clients: Cisco has confirmed a critical vulnerability in the Advanced Malware Protection feature of the Secure Email Gateway. It is being actively exploited, and the fix is to update the Content Scanner Tools package or upgrade the AsyncOS software. We are checking which of our managed appliances are affected and will patch internet-facing devices first.

Longer version for clients who ask: the vulnerability lets an unauthenticated, remote attacker write files and run commands as root on the email gateway. That is the device that scans email for malware, so an attacker who compromises it can interfere with the very security controls meant to protect the inbox. We are treating this as urgent and will confirm that each appliance is patched and has no signs of compromise.

Ask clients not to disable or reboot the gateway outside the maintenance window you set. A partially patched email gateway can create mail flow gaps, and an unpatched one is the bigger risk. Let them know the maintenance window and what you will do if you find indicators of compromise.

Frequently Asked Questions

Sources

• 2026-017: Critical Vulnerability in Cisco Secure Email GatewayCert Eu · Official