Cisco PSIRT disclosed and patched an actively exploited path-traversal in Secure Email Gateway's Advanced Malware Protection (AMP) File Reputation handling (CVSS 9.8). An unauthenticated attacker who can send mail through the appliance can write arbitrary files and run commands as root when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525. No workarounds. Fix via Content Scanner Tools ≥25.3.0.5525 (no restart) or AsyncOS 15.5.5-014 / 16.5.0-780. Cisco says it has contacted Secure Email Cloud customers where compromise indicators were found. CISA added the CVE to KEV on Oct 14 (due Oct 17; forensic triage required). Check contentscannerstatus and grep "System Security" system_logs for IoCs.