VIR Vulnerability Intelligence Relay

CVE-2016-6360

high
Published 2016-10-28 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.5

Description

A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition due to the AMP process unexpectedly restarting. Affected Products: Cisco AsyncOS Software for Email Security Appliances (ESA) versions 9.5 and later up to the first fixed release, Cisco AsyncOS Software for Web Security Appliances (WSA) all versions prior to the first fixed release. More Information: CSCux56406, CSCux59928. Known Affected Releases: 9.6.0-051 9.7.0-125 8.8.0-085 9.5.0-444 WSA10.0.0-000. Known Fixed Releases: 9.7.1-066 WSA10.0.0-233.

Predictions

Exploit likelihood
83%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
cisco ciscoemail_security_appliance9.5.0-000
cisco ciscoemail_security_appliance9.5.0-201
cisco ciscoemail_security_appliance9.6.0-000
cisco ciscoemail_security_appliance9.6.0-042
cisco ciscoemail_security_appliance9.6.0-051
cisco ciscoemail_security_appliance9.7.0-125
cisco ciscoweb_security_appliance8.8.0-085
cisco ciscoweb_security_appliance9.0.0-193
cisco ciscoweb_security_appliance9.0_base
cisco ciscoweb_security_appliance9.1.0-000
cisco ciscoweb_security_appliance9.1.0-070
cisco ciscoweb_security_appliance9.1_base
cisco ciscoweb_security_appliance9.5.0-235
cisco ciscoweb_security_appliance9.5.0-284
cisco ciscoweb_security_appliance9.5.0-444
cisco ciscoweb_security_appliance9.5_base

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.