Cisco Secure Email EUVD-2026-101420

Exploitation requires that the Advanced Malware Protection (AMP) feature's file reputation service be enabled on the Cisco Secure Email Gateway; this is the specific feature state named in the advisory as the root cause of improper attachment handling. When that service is active, exploitation needs only that an attacker be able to send an email with a crafted attachment through the device (AV:N/AC:L/PR:N/UI:N) - no authentication, no recipient interaction, and no non-default network access. The practical limiting factor is purely configuration: gateways without file reputation enabled are not affected, so defenders should inventory which appliances have AMP file reputation active to scope exposure.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated, no-interaction flaw, and the description's mechanics corroborate it: an attacker merely sends an email with a crafted attachment through the gateway, with no credentials and no victim action required. CWE-23 (relative path traversal) combined with the stated outcome - arbitrary file write escalating to command execution with root privileges - makes the technical impact total on the affected appliance. The signals are internally consistent with no contradictions between the vector and the prose. The tempering factors are the absence of exploitation-probability signals: there is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis. The only exploitation precondition is that the AMP file-reputation service be enabled - a common configuration on these gateways. Net assessment: maximal technical severity and trivial exploitability warrant emergency patching, while the lack of KEV/EPSS/POC signals means active exploitation is not currently confirmed, so this is 'patch immediately on severity/exposure grounds' rather than 'confirmed under attack.'

An external attacker sends an ordinary-looking email with a specially crafted malicious attachment to any recipient behind an affected Cisco Secure Email Gateway that has AMP file reputation enabled. As the gateway processes the attachment, improper path handling lets the attacker write arbitrary files to the underlying OS and ultimately execute commands as root. No authentication, no user interaction, and no public exploit code is required or known at this time.