CVE-2016-9091

This vulnerability lets a malicious administrator type commands that the system runs as if they were the server itself. Think of it like an “admin console” that, if misused, can execute anything on the machine—not just change settings. Because admin access is required, the biggest risk is if an attacker gets (or is already) logged in as an administrator.

This matters if your business uses Blue Coat Advanced Secure Gateway (ASG) or the Content Analysis System (CAS) software in affected versions. The dangerous part requires an attacker to have authenticated admin-level access, so it’s primarily a risk if someone can log in as an administrator or if admin credentials are compromised. The risk is present only when the vulnerable versions are in use and an attacker can reach the system with admin authentication (unauthorized internet reachability alone isn’t the main requirement based on the findings).

Treat this as an urgent security risk within your environment because public exploits are available and the weakness allows elevated command execution. Even though it needs an authenticated malicious administrator, real-world compromise often starts with stolen or over-privileged admin access, so you should act to identify affected versions and lock down admin access now. The overall severity is reflected in a traffic-light AMBER posture: prioritize remediation, but focus on confirmed exposure and access control first.

Confirm exposure (affected version)

• Locate the installed versions for:
  • Blue Coat Advanced Secure Gateway (ASG) 6.6 (determine if it is earlier than 6.6.5.4)
  • Content Analysis System (CAS) 1.3 (determine if it is earlier than 1.3.7.4)
• If either component is within the affected range, assume you are exposed to the command injection behavior described.

Confirm availability of a fix

• The provided findings state no fix/patch information is available. That means you cannot reliably self-select a “known-good” fixed version from this data alone.
• Ask your vendor/support channel or MSP for:
  • The exact fixed release (if one exists) for your ASG and CAS build
  • Upgrade steps and any compatibility considerations for your network deployment

Reduce the most important risk factor: admin access

Because exploitation requires an authenticated malicious administrator, the practical mitigation focus is preventing attackers from obtaining that level of access.

• Inventory all admin users and remove any that are not strictly necessary.
• Enforce/verify strong authentication for admin accounts and lockouts/monitoring for repeated failed logins.
• Review recent admin logins and changes around the time window you care about (especially after any password resets or support actions).

Temporary compensating controls (if patching is delayed)

• Limit network reachability to these systems’ administrative interfaces to only required sources (e.g., specific management subnets/bastion hosts).
• Block or restrict any unnecessary inbound management access.
• Increase monitoring around configuration changes and unusual admin-driven behavior.

What to monitor

• Unexpected or out-of-hours admin logins.
• Changes to system configuration that normally require controlled procedures.
• Signs of process creation/spawn behavior that doesn’t match typical operation (log sources depend on your deployment).

KEV / exploitation status note

• This CVE is not listed in CISA KEV in the provided findings, but there is public exploit availability. That combination supports prioritizing remediation and access hardening now.

Due dates

• No CISA due date is provided in the findings.

Severity and weakness

• Weakness type: CWE-78 (OS command injection).
• Impact capability: an authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges, which can lead to full compromise, data theft, and denial of service.

Affected products and versions

• advanced secure gateway (Blue Coat ASG) 6.6 before 6.6.5.4.
• content analysis system software (Blue Coat CAS) 1.3 before 1.3.7.4.

Exploit maturity / public availability

• The findings indicate public exploits exist (2 known), increasing the likelihood that attackers can readily weaponize this issue.
• No KEV listing is provided, so this is not confirmed as a KEV-tracked vulnerability in the supplied data.

Attack vector and prerequisites

• Exploitation requires authenticated malicious administrator access, aligning with the mechanism described in the findings.
• Because admin authentication is required, the main real-world risk driver is compromise or misuse of admin credentials.

EPSS note

• EPSS is reported as a prediction in the findings (trend: falling), but public exploitation availability is treated as more actionable than predictions.

KEV meaning here

• “Not listed in CISA KEV” means it has not been included in that specific CISA catalog based on the provided data; it does not negate the presence of public exploits.