Cisco has released patches for a critical vulnerability in its Secure Email Gateway that allows unauthenticated remote code execution with root privileges.
The flaw is being actively exploited and impacts installations with the File Reputation service enabled.
Impacted systems must be updated to Content Scanner Tools version 25.3.0.5525 or newer, or the specific patched AsyncOS versions 15.5.5-014 or 16.5.0-780, as no workaround exists.
Which systems are affected?
The problem does not affect all Cisco customers, but only those who meet two specific conditions:
- They have the File Reputation service enabled.
- They are using an older version of the Content Scanner Tools prior to version 25.3.0.5525.
Cisco identified the vulnerability during an internal audit and began recording incidents of attacks in October 2026. Companies using the Secure Email Cloud service that showed signs of a breach have already received relevant information from the company.
Correcting the problem
There is no other way to protect yourself than to update your software. Cisco has released an update that permanently closes the vulnerability. Administrators should upgrade their scanning tools to version 25.3.0.5525 or later. The fix is also included in certain versions of AsyncOS (15.5.5-014 and 16.5.0-780).
READ ALSO
Fraud ring with fake employees financed North Korea
What to do in case of a violation
If a business discovers that its system has been compromised, simply upgrading is not enough. According to Cisco, in this case the following is required:
- Complete reinstallation of the system from scratch.
- Change all passwords and digital keys used on the device.
The company warns that upgrading software on an already compromised device may destroy digital logs, which are necessary to determine exactly what happened.
G
Hacks.gr on Google
Set it as your preferred source for cybersecurity updates.
Preferred source
Top comments (0)