Description

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:19:10.747Z",
  "pubdate": "2026-10-14T17:19:10.747Z",
  "executiveSummary": "This vulnerability pertains to an arbitrary file write flaw within the Advanced Malware Protection (AMP) feature of the Cisco Secure Email Gateway.\nThe vulnerability allows an unauthenticated, remote attacker to gain root-level code execution on the underlying operating system of the targeted device.\nThe core issue stems from improper validation and handling of malicious email attachments during the file reputation inspection process.\nAn attacker can exploit this by transmitting a specifically crafted email attachment through a system where the AMP service is active.\nThe impact is critical, as it grants full administrative control over the appliance, potentially leading to total system compromise, data exfiltration, or lateral movement within the network.\nThe vulnerability does not require authentication, making it particularly dangerous for internet-facing email gateways.",
  "technicalDetails": "The vulnerability resides within the file analysis engine of the Advanced Malware Protection (AMP) component in Cisco Secure Email Gateway. The flaw is triggered during the processing of incoming email attachments that are subjected to the file reputation service.\nThe root cause is an improper handling mechanism that fails to securely sanitize or validate the file paths and content types provided within the attachment metadata or container structure. When the AMP engine parses a malformed or maliciously crafted attachment, it fails to enforce adequate boundary checks, leading to a path traversal or directory injection vulnerability.\nThe attack flow begins when an attacker sends an email containing a weaponized attachment to an address handled by the affected Cisco Secure Email Gateway. Upon delivery, the gateway's AMP module intercepts the attachment to perform reputation checks. Due to the lack of secure handling, the crafted file allows the attacker to specify an arbitrary destination on the underlying operating system's filesystem.\nBy manipulating the attachment headers or file structure, the attacker can overwrite critical system configuration files, binaries, or libraries. Because the AMP service operates with high-level permissions on the underlying operating system, the write operation is performed with root privileges.\nFollowing the arbitrary file write, the attacker can leverage the filesystem access to achieve persistent code execution. This may involve overwriting a system binary or a scheduled task/cron job to execute a reverse shell or other malicious payloads. The exploitation provides the attacker with root access, allowing them to bypass all existing security controls, intercept encrypted email traffic, modify system policies, or pivot into the internal network infrastructure.\nThe attack is remote and unauthenticated, requiring no prior knowledge of the gateway's internals beyond the SMTP transport mechanism. The successful execution results in a complete compromise of the appliance's integrity, confidentiality, and availability."
}