You patched your Cisco email gateway. One email can still take it over.

Someone can take over a Cisco email gateway by sending it one email, and nobody has to click anything. If you run these gateways yourself, get them to 16.5, then check whether anyone got in before you did.

An email gateway is a bad machine to lose. It sits in the path of your mail, and it holds working credentials for the systems around it. Cisco's own upgrade notes list what's stored in its configuration: certificate private keys, LDAP bind passwords, DKIM signing keys, SAML certificate passphrases and outgoing SMTP passwords. Anyone with root can go after all of that.

Nobody has said publicly who's behind this or how many gateways were hit. Rapid7 reads the same-day KEVdefinitionCISA's Known Exploited Vulnerabilities catalog, the US government's list of bugs with evidence of real attacks. Federal agencies get deadlines from it. listing as a sign the SQL bug was used before Cisco disclosed it. CISA lists ransomware use as unknown for both flaws, so don't read that as a no. Rapid7 also said in its write-up that no public exploit code existed at the time. Cisco has since referred to exploit code available online, without saying where it is or what it does, so plan as if anyone can get it.

A firewall won't save you here. The gateway has to accept mail from the internet to do its job, so the attack arrives through the door it's meant to keep open. Cisco says the SQL flaw affects gateways regardless of how they're configured, physical or virtual.

Engineers will notice Cisco's sample search, COPY.*TO PROGRAM. That's the shape of PostgreSQL's COPY ... TO PROGRAM statement, which makes a database server run a shell command. Cisco doesn't name the database in its advisory, so treat this as a clue about what to hunt for. The second bug takes a different route. It's a path traversal in how the gateway handles attachments when File Reputation is on, and it lets an attacker write files and run commands as root. The Hacker News reports that the two sit in different parts of the software and that Cisco hasn't linked the attacks.

Watch the build number when you compare notes. The Hacker News's September report prints the 15.5 fix as 15.5.5-0141, and that build isn't in Cisco's table. Cisco's advisory says 15.5.5-014. Check your gateways against Cisco's table, and don't copy a build number out of a news story.

# Attempted SQL injection: run it on every cluster member. Any hit may be bad news
cisco-esa> grep -i "COPY.*TO PROGRAM" mail_logs
# Attachment flaw: Cisco's compromise check
cisco-esa> grep "System Security" system_logs
# On 15.5.5-014: engine must be 4.0.2 or later
cisco-esa> retroscannerstatus
# Must be 25.3.0.5525 or later
cisco-esa> contentscannerstatus
cisco-esa> contentscannerupdate

Cisco wants everyone below 16.5 on 16.5.0-780. Check the route before you book the window, because the two sets of notes differ. Cisco's October notes for 16.5.0-780 don't list any 15.5.5 build as a starting point, while its November notes for 16.5.0-825 list 15.5.5-014 and 16.0.4-302. If you're on 15.5.5-014, that makes 16.5.0-825 the documented route. Cisco also warns that some listed paths get pulled, so open the Deprovisioned AsyncOSdefinitionCisco's operating system for its Secure Email Gateway, on physical and virtual appliances alike. Check this version number first, since it decides whether you're fixed. Releases tab in its compatibility matrix first.

BleepingComputer points out this is hardly the first time. Cisco patched another maximum-severity AsyncOS flaw in January, CVE-2025-20393, after attackers had been using it since November 2025. So assume the gateway will have another bad day, and limit what an attacker gets when it does.

We don't sell or run Cisco's email gateways, so your email team or provider does the upgrade. We come in afterwards and replace what the gateway knew. Our privileged access management team tracks down the bind accounts and service logins tied to appliances like this, moves them into a vault like CyberArk and schedules rotation. When the cleanup needs more hands, our CyberArk engineers can join for a few weeks. Not sure what your appliances can reach? Start with the free assessment.