What Happened
A critical Cisco Secure Email Gateway vulnerability is under active exploitation, and CERT-EU is telling organizations to patch now. The flaw is in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated, remote attacker can exploit it to write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco PSIRT is aware of active exploitation, so this is not a theoretical risk.
Cisco published the advisory on 14 October 2026. CERT-EU recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS Software to a fixed release as soon as possible, prioritising internet-facing appliances, and checking affected appliances for indicators of compromise.
For an MSP, an exploited email gateway means more than a technical fix. It means a client's email flow is in an attacker's hands, and recovery work starts immediately. The longer an appliance stays exposed, the more time an attacker has to move from the gateway to other systems.
Why MSPs Should Care
Email gateways sit at the edge of the network and process untrusted traffic by design. A root-level compromise on that device gives an attacker access to mail queues, content inspection logs, and the credentials or rules the appliance uses to talk to the rest of the environment. That makes it a strong entry point for lateral movement.
When a client's email is down, the client cannot invoice, receive orders, or reset passwords. Every hour of downtime becomes a support ticket and a potential client retention problem. The direct cost is lost productivity; the bigger cost is the damage to trust.
MSPs also carry the responsibility for knowing which clients run the affected product. That inventory is what lets you prioritise internet-facing appliances and respond before an attacker does. If you do not know, the first sign of the problem may be a client calling to say email stopped working.
Timeline
- 14 October 2026: Cisco published a security advisory for a critical vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway.
Who Is Affected
Any organization running Cisco Secure Email Gateway with the Advanced Malware Protection feature is potentially affected. The source advisory does not list specific software versions, so the safe assumption is that every deployment of the affected product should be treated as exposed until the Content Scanner Tools package or Cisco AsyncOS Software is updated.
Internet-facing appliances are the highest priority. CERT-EU specifically says to prioritise appliances reachable from the internet, because those are the ones an external attacker can reach without first compromising another system. MSPs should also check whether any client appliance is managed on their behalf and confirm who is responsible for patching it.
Because the vulnerability is being actively exploited, do not wait for a convenient maintenance window. Treat this as an emergency change and communicate the risk to the client.
Technical Details
The source advisory provides the following details. It does not include a CVE identifier or a list of affected software versions in the public summary.
- Affected product: Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway.
- Attack vector: unauthenticated, remote attacker.
- Impact: write arbitrary files and execute commands with root privileges on the underlying operating system.
- CVE: none stated in the source advisory summary.
- Software versions: none stated in the source advisory summary.
Cisco Secure Email Gateway Vulnerability: What MSPs Should Do
Treat this as a critical exposure on any appliance that can be reached from the internet. Take these steps now.
- Update the Content Scanner Tools package or upgrade Cisco AsyncOS Software to a fixed release as soon as possible.
- Prioritise appliances reachable from the internet.
- Check all affected appliances for indicators of compromise.
- As a standing practice, isolate affected appliances from the rest of the network until they are patched and reviewed.
- As a standing practice, restrict management access to trusted networks and enforce multi-factor authentication.
- As a standing practice, confirm that you have clean restorable backups of the appliance configuration and any systems that depend on it.
How EnterProtect Helps
When a client is hit, speed to recovery is what protects the relationship. EnterProtect backup keeps clean restorable copies of client systems and configurations, so you have a known good state to return to after an incident. EnterProtect recovery gets a client running again when email and business systems are down. EnterProtect vulnerability scanning finds exposed versions across your client base, so you can see where patching is overdue and focus your team on the highest-risk systems.
EnterProtect is built for the way MSPs work: you need visibility, clean backups, and a recovery path when a client is down. None of that replaces patching this vulnerability today. It is the safety net that makes sure one exploited gateway does not become a lost client.
Frequently Asked Questions
What Is the Cisco Secure Email Gateway Vulnerability?
The vulnerability affects the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated, remote attacker can exploit it to write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco PSIRT is aware of active exploitation.
Is This Vulnerability Being Actively Exploited?
Yes. The Cisco PSIRT is aware of active exploitation, and CERT-EU published a critical advisory recommending immediate patching. Treat any affected appliance as at risk until it is updated.
Which Cisco Products Are Affected?
The affected product is Cisco Secure Email Gateway with the Advanced Malware Protection (AMP) feature. The public advisory summary does not list specific software versions, so check Cisco's advisory and your appliance's current release.
What Should I Do If My Client Runs Cisco Secure Email Gateway?
Update the Content Scanner Tools package or upgrade Cisco AsyncOS Software to a fixed release as soon as possible. Prioritise internet-facing appliances, and check all affected appliances for indicators of compromise. As a standing practice, isolate affected systems until they are patched.
Can I Tell If an Appliance Has Been Compromised?
Check all affected appliances for indicators of compromise, as CERT-EU recommends. Look for unexpected files, unauthorised configuration changes, and suspicious outbound connections. If you find signs of compromise, treat the appliance as untrusted and restore from a clean backup.
Sources
- 2026-017: Critical Vulnerability in Cisco Secure Email Gateway (Cert Eu)