Cisco has already contacted Secure Email Cloud customers where it found compromise indicators

An attacker sends an email through the gateway and reaches the vulnerable code without credentials ^[1]. Douglas McKee, director of vulnerability intelligence at Rapid7, told CyberScoop: "The combination here is pretty ugly. No authentication is required, an attacker can reach the vulnerable code by sending an email through the appliance, successful exploitation can result in root-level command execution, and Cisco has observed exploitation in the wild." ^[10] On what that access is worth to an operator, he said: "In practical terms, that gives the attacker control of the gateway itself." ^[9]

Where the appliance sits decides how far that control reaches. Spencer McIntyre, director of exploit development at VulnCheck, told CyberScoop that "It's going to be worse for organizations that have the appliance deployed on-premises. In this case, the attacker could pivot internally," and that a compromised cloud instance "is less likely to have significant access to internal organizational resources." ^[14]

The operator is still unnamed. Authorities and researchers described the attackers as being of unknown origins and motivations when the exploitation was confirmed Monday ^[2]. McIntyre put the plausible objective this way: "Stealing or silently snooping on email comms is a common tactic for state-sponsored and other threat actors conducting espionage operations." ^[13]

The window opens in September, when Cisco's product security incident response team learned of active exploitation, and closes at Monday's patch ^[16]. Where retention on the appliance and on mail logs is shorter than that, the surviving record does not cover the whole period of known exploitation ^[20].

Rapid7 and VulnCheck both said they do not yet know how many organizations have been affected, and both told Cisco customers to patch and to hunt for signs of compromise as soon as possible ^[15].