1-minute read
What a defender needs to know
Two underlying findings in Cisco’s Secure Email hardening advisory are actively exploited: an arbitrary-file-write issue in the path-traversal group and a SQL-injection issue in the improper-neutralization group. The advisory was updated October 14 to add a related-advisory link. It addresses five weakness groups across Secure Email Gateway and Secure Email and Web Manager, affected regardless of configuration. Cisco Secure Web Appliance is outside the affected scope. A single CVE in this release groups multiple findings, and the group’s score is the highest score among them.
Inventory both affected products and read each appliance’s installed build. Secure Email Gateway first fixes are 15.5.5-014 on the 15.5 line and 16.5.0-780 on 16.5. Secure Email and Web Manager first fixes are 15.5.5-006 and 16.5.0-429 respectively. For either product on 16.0, migrate to a fixed release. Cisco offers no workaround. Schedule the appliance update using System Administration > System Upgrade or the CLI upgrade workflow; Secure Email Cloud customers can request an upgrade through Cisco support.
For exposed appliances, preserve logs and ask Cisco TAC for issue-specific investigation guidance while arranging the upgrade. After reboot, read the running build and compare it with the correct product row in Cisco’s fixed-release table.