CVE-2017-6327: Symantec Messaging Gateway command injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is a network-reachable remote code execution flaw with a public exploit and confirmed exploitation in CISA KEV, despite requiring low privileges.

What it is

Symantec Messaging Gateway before 10.6.3-267 is affected by a command injection flaw that allows remote code execution. An attacker who can reach the affected interface and has low-privileged access can run commands on the target, then attempt to elevate privileges. The record does not specify the exact vulnerable component or the full set of affected versions beyond the fixed build.

Impact

An attacker gains the ability to execute arbitrary commands on the Messaging Gateway host or in its process context, with high impact to confidentiality, integrity and availability. Post-exploitation privilege escalation is explicitly noted as a possible follow-on step.

Attack surface

The CVSS vector is network-reachable (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so an authenticated low-privileged user on the network can trigger it. The description does not identify the specific endpoint or interface involved.

Exploitation

CVE-2017-6327 is listed in CISA KEV (added 2021-11-03), indicating known exploitation in the wild, and EPSS is high at roughly 0.35 (98th percentile). A public Exploit-DB entry (42519) exists, and no ransomware campaign use is documented.

What to do

• Upgrade Symantec Messaging Gateway to 10.6.3-267 or later, per the vendor advisory.
• If immediate upgrade is not possible, restrict network access to the Messaging Gateway management and service interfaces to trusted hosts only.
• Audit and reduce accounts with low-privileged access to the appliance; remove or disable unused accounts.
• Monitor for and block outbound command-and-control or unexpected process execution from the appliance host.
• Apply the vendor's required action from the CISA KEV entry and track remediation to the 2022-05-03 due date if still outstanding.

Detection

• Monitor Messaging Gateway logs for unexpected command execution, shell invocations, or child processes spawned by the appliance's web/service components.
• Alert on unusual outbound network connections from the Messaging Gateway host, especially to non-standard destinations.
• Review authentication and authorization logs for low-privileged accounts accessing administrative or command-related endpoints.
• Hunt for known public exploit artifacts (Exploit-DB 42519) in web access logs and process telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.