Cisco Email Gateway Hit by Second Root Zero-Day in a Month: What Security Teams Should Do

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Hardens enterprise and cloud stacks for US and EU teams

The short version

What did Cisco disclose?

Cisco's advisory describes a path traversal in the Advanced Malware Protection (AMP) feature of Secure Email Gateway, the appliance formerly known as Email Security Appliance. When the gateway processes an attachment, it does not correctly restrict file paths, so a crafted file can be written outside the intended directory. Cisco says a successful attack lets the attacker write arbitrary files and run commands with root privileges on the underlying operating system.

No login and no user click are needed: the attacker only has to get a message to the gateway, which is exactly what a mail gateway exists to accept. Cisco's PSIRT says it became aware of active exploitation in October 2026 and that a limited number of customers are affected. It has not named the attackers or described what they did after getting in.

Who is exposed?

Both physical and virtual gateways are in scope, but only when two settings line up. The File Reputation service must be enabled and assigned to a mail policy, and the Content Scanner Tools component must be older than 25.3.0.5525. Administrators can read the component version with the contentscannerstatus CLI command and check the “Enable File Reputation” box under Mail Policies > Advanced Malware Protection.

Cisco says the fix lives in Content Scanner Tools 25.3.0.5525 and later, and updating that component needs neither a reboot nor a full AsyncOS upgrade. For teams that prefer a full release, Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as first fixed; 16.0 customers have to migrate. The hosted Secure Email Cloud Gateway has already been mitigated by Cisco, which contacted customers where it found signs of compromise.

Why does the email gateway keep getting hit?

This is the second unauthenticated root zero-day in the same product family in about a month. In September, Cisco patched CVE-2026-76461, a flaw in AsyncOS email parsing, and in January it fixed CVE-2025-20393, a maximum-severity AsyncOS bug that attackers used to plant persistence. The new bug sits in a different place — the malware-scanning path — so patching September's issue did not help.

The pattern makes sense from an attacker's view. A mail gateway takes untrusted input from the whole internet, unpacks and parses complex file formats, runs on an appliance that rarely has endpoint detection, and sits next to sensitive mail flows. The very feature that inspects dangerous attachments becomes the attack surface. According to The Register, CISA has added 100 Cisco vulnerabilities to KEV since November 2021.

What it means for US & EU teams

Root on a mail gateway means potential access to everything that passes through it: invoices, contracts, password-reset links, customer correspondence. For companies under GDPR, NIS2 or DORA, an exploited gateway is a possible personal-data incident, and the reporting clock starts when you become aware of it. Teams need evidence, not just a patched version number: Cisco's own log check plus firewall and proxy records of unusual uploads or downloads from the appliance.

The second lesson is about patch pipelines. Many organizations only patch appliances during full-firmware maintenance windows. Here the fix is a scanner component that updates separately, so teams that track only the AsyncOS version can miss it. Inventories for edge security devices should list sub-components and signature engines, not just the main OS build.

Finally, two root-level bugs in a month is a reason to look at blast radius. Restricting the gateway's outbound connections, keeping its management interface off the internet, and segmenting it from internal systems turns the next zero-day from a breach into a contained incident.

What to do this week

1. Check exposure. Run contentscannerstatus on every gateway and confirm whether File Reputation is on in any mail policy.
2. Update the scanner. Move Content Scanner Tools to 25.3.0.5525 or later (no reboot), or upgrade to AsyncOS 15.5.5-014 / 16.5.0-780.
3. Run the compromise check. Use grep "System Security" system_logs as Cisco recommends; if a compromise indicator appears, follow the advisory, and if the scan did not complete, open a TAC case.
4. Look outside the box. Review firewall and network logs for odd traffic to and from the appliance since early October, because an attacker with root can wipe local evidence.
5. Rotate and contain. If compromise is suspected, rotate gateway admin and integration credentials, and limit the appliance's outbound access.

Frequently asked questions

Sources

Cisco — Cisco Secure Email Gateway Arbitrary File Write Vulnerability, cisco-sa-esa-afw-zqYJkjxp (October 14, 2026)
BleepingComputer — Cisco patches new Secure Email Gateway zero-day exploited in attacks (October 14, 2026)
The Register — Cisco make-me-root email bug exploited as a 0-day by unknown crims (October 14, 2026)