CVE-2016-9091: bluecoat advanced_secure_gateway OS Command Injection
Vulnerability summary
CVE-2016-9091 is a high (CVSS 9.0) OS Command Injection vulnerability in bluecoat advanced_secure_gateway. EPSS estimates a 9.58% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 05-04-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 and Content Analysis System (CAS) 1.3 before 1.3.7.4 are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
9.58%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-0.55 pp
From 10.13% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundBluecoat ASG 6.6/CAS 1.3 - Local Privilege Escalation (Metasploit)
Maturity: weaponized
Bluecoat ASG 6.6/CAS 1.3 - OS Command Injection (Metasploit)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Bluecoat2 products
- advanced_secure_gateway≤ 6.6.5.2
- content_analysis_system_software≤ 1.3.7.3
Symantec corporation2 products
- blue coat asg6.6 prior to 6.6.5.4
- blue coat cas1.3 prior to 1.3.7.4
2 vendors · 4 products